The Data Protection (Subject Access Modification) (Education) Order 2000

Explanatory Note

(This note is not part of the Order)

This Order provides for the partial exemption from the provisions of the Data Protection Act 1998, which confer rights on data subjects to gain access to data held about them, of certain data (education records) where the exercise of those rights would be likely to cause serious harm to the physical or mental health or condition of the data subject or another person, or, in some circumstances, (except in the case of Scotland) would disclose information as to whether the data subject is or has been the subject of or may be at risk of child abuse which disclosure would not be in the best interests of that data subject. The Order does not apply to any data to which the Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413) or any order made under section 38(1) of the Act applies (article 3(2)).

In the case of court reports in certain proceedings where information in the report may be withheld by the court, there is a complete exemption under article 4 of the Order from both section 7 of the Act and the first data protection principle to the extent to which it requires compliance with paragraph 2 of Part II of Schedule 1 to the Act (which confers obligations on data controllers to give certain information to data subjects relating to data held about them). For other personal data to which the Order applies, there is an exemption from section 7 of the Act only (article 5).

Article 7 of the Order also modifies section 7 of the Act so that a data controller cannot refuse access on the grounds that the identity of a third party would be disclosed in cases where the third party is a relevant person (as defined), unless serious harm to that relevant person’s physical or mental health or condition is likely to be caused such that the exemption in article 5(1) applies.

In the case of data controllers which are education authorities in Scotland who receive certain data from the Principal Reporter, article 6 requires such data controllers to obtain the Principal Reporter’s opinion on whether the disclosure of the information might cause serious harm to anyone before responding to any section 7 request.

This Order contributes to the implementation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

A Regulatory Impact Assessment was prepared for the Data Protection Bill as it was then and the statutory instruments to be made under it, and was placed in the libraries of both Houses of Parliament. The Regulatory Impact Assessment is now available on the internet at www.homeoffice.gov.uk. Alternatively, copies can be obtained by post from the Home Office, LGDP Unit, 50 Queen Anne’s Gate, London SW1H 9AT.