1987 No. 1903

DATA PROTECTION

The Data Protection (Subject Access Modification) (Health) Order 1987

Made

Coming into force

Whereas a draft of this Order has been laid before and approved by a resolution of each House of Parliament:

Now, therefore, in exercise of the powers conferred upon me by section 29(1) and (3) of the Data Protection Act 1984 1 and after consultation with the Data Protection Registrar in accordance with section 40(3) of that Act, I hereby make the following Order:

1

This Order may be cited as the Data Protection (Subject Access Modification) (Health) Order 1987 and shall come into force on 11th November 1987.

2

In this Order—

  • “the Act” means the Data Protection Act 1984;

  • “care” includes examination, investigation and diagnosis;

  • “dental practitioner” and “medical practitioner” mean, respectively, a person registered under the Dentists Act 1984 2 and the Medical Act 1983 3;

  • “health authority” has the same meaning as in section 128(1) of the National Health Service Act 1977 4;

  • “Health Board” has the same meaning as in section 108(1) of the National Health Service (Scotland) Act 1978 5;

  • “Health and Social Services Board” has the same meaning as in Article 16 of the Health and Personal Social Services (Northern Ireland) Order 1972 6;

  • “health professional” means any person listed in the Schedule to this Order; and “the subject access provisions” has the meaning which it has for the purposes of Part IV of the Act.

3

1

This Order applies to personal data consisting of information as to the physical or mental health of the data subject if—

a

the data are held by a health professional; or

b

the data are held by a person other than a health professional but the information constituting the data was first recorded by or on behalf of a health professional.

2

This Order is without prejudice to any exemption from the subject access provisions contained in any provision of the Act or of any Order made under the Act.

4

1

The subject access provisions shall not have effect in relation to any personal data to which this Order applies in any case where either of the requirements specified in paragraph (2) below is satisfied with respect to the information constituting the data and the obligations contained in paragraph (5) below are complied with by the data user.

2

The requirements referred to in paragraph (1) above are that the application of the subject access provisions—

a

would be likely to cause serious harm to the physical or mental health of the data subject; or

b

would be likely to disclose to the data subject the identity of another individual (who has not consented to the disclosure of the information) either as a person to whom the information or part of it relates or as the source of the information or enable that identity to be deduced by the data subject either from the information itself or from a combination of that information and other information which the data subject has or is likely to have.

3

Paragraph (2) above shall not be construed as excusing a data user—

a

from supplying the information sought by the request for subject access where the only individual whose identity is likely to be disclosed or deduced as mentioned in sub-paragraph (b) thereof is a health professional who has been involved in the care of the data subject and the information relates to him or he supplied the information in his capacity as a health professional; or

b

from supplying so much of the information sought by the request as can be supplied without causing serious harm as mentioned in sub-paragraph (a) thereof or enabling the identity of another individual to be disclosed or deduced as mentioned in sub-paragraph (b) thereof, whether by the omission of names or other particulars or otherwise.

4

In relation to data to which this Order applies, section 21 of the Act shall have effect as if subsections (4)(b) and (5) were omitted and as if the reference in subsection (6) to the consent referred to in the said section 21 (4)(b) were a reference to the consent referred to in paragraph (2)(b) above.

5

A data user who is not a health professional shall not supply information constituting data to which this Order applies in response to a request under section 21 and shall not withhold any such information on the ground that one of the requirements specified in paragraph (2) above is satisfied with respect to the information unless the data user has first consulted the person who appears to the data user to be the appropriate health professional on the question whether either or both of those requirements is or are so satisfied.

6

In paragraph (5) above “the appropriate health professional” means—

a

the medical practitioner or dental practitioner who is currently or was most recently responsible for the clinical care of the data subject in connection with the matters to which the information which is the subject of the request relates; or

b

where there is more than one such practitioner, the practitioner who is the most suitable to advise on the matters to which the information which is the subject of the request relates; or

c

where there is no practitioner available falling within sub-paragraph (a) or (b) above, a health professional who has the necessary experience and qualifications to advise on the matters to which the information which is the subject of the request relates.

7

Section 21(8) of the Act shall have effect, in relation to data to which this Order applies, as if the reference therein to a contravention of the foregoing provisions of that section included a reference to a contravention of the provisions contained in this Article.

Home Office

Douglas HurdOne of Her Majesty’s Principal Secretaries of State

SCHEDULEHEALTH PROFESSIONALS

Article 2

DESCRIPTION

STATUTORY DERIVATION

(where applicable)

Registered medical practitioner

Medical Act 1983 7, section 55.

Registered dentist

Dentists' Act 1984 8, section 53(1).

Registered optician

Opticians Act 1958 9, section 30(1).

Registered pharmaceutical chemist or druggist

Pharmacy Act 1954 10, section 24(1). Pharmacy (Northern Ireland) Order 1976 11, Article 6(1).

Registered nurse, midwife or health visitor

Nurses, Midwives and Health Visitors Act 1979 12, section 10.

Registered chiropodist, dietician, occupational therapist, orthoptist or physiotherapist (subject to the Note below.)

Professions Supplementary to Medicine Act 1960 13, section 10.

Clinical psychologist, child psychotherapist or speech therapist

Art therapist or music therapist employed by a health authority, Health Board or Health and Social Services Board

Scientist employed by such an authority or Board as a head of department

Note This category shall be construed as not including any person belonging to a profession specified in the first column which, by virtue of an Order under section 10 of the Professions Supplementary to Medicine Act 1960, is for the time being treated as if it were not mentioned in section 1(2) of that Act and as including any person belonging to a profession not specified therein which is for the time being treated by virtue of such an Order as if it were mentioned therein.

(This note is not part of the Order)

This Order provides for the partial exemption from the provisions of the Data Protection Act 1984 which confer rights on data subjects to gain access to data held about them (“the subject access provisions”) of data relating to the physical or mental health of the data subject held by any data user where the data are held by a health professional or the information constituting the data was first recorded by or on behalf of a health professional. Schedule 1 to the Order lists the persons who are health professionals for the purposes of the Order.

The subject access provisions are disapplied only where to supply the data subject with particulars of the information constituting the data would be likely to cause serious harm to his physical or mental health or lead to the identification of another person (other than a health professional who has been involved in the care of the data subject). Before deciding whether either of those criteria is met (and, accordingly, whether to grant or withhold subject access) a data user who is not a health professional is obliged by the Order to consult the medical practitioner or dental practitioner responsible for the clinical care of the data subject or, if there is more than one, the most suitable available medical or dental practitioner or if there is none available a health professional who has the necessary experience and qualifications to advise on the matters to which the information which is requested relates.