Enforced subject access requests will be a criminal offence from 1 December

With effect from 1 December 2014, section 56 of the Data Protection Act 1998 (DPA) will come into force, making it a criminal offence to request an enforced subject access request.

Enforced subject access occurs where one person is compelled, for example by an employer or prospective employer, to make a subject access request under the DPA and then provide the response.

Employers cannot apply for criminal records checks on employees or applicants, except in specific circumstances, and therefore such requests allow employers to access information about the criminal records of job applicants or employees for a variety of reasons. That information might include spent convictions under the Rehabilitation of Offenders Act 1974.

Both the Information Commissioner and the Disclosure and Barring Service have expressed concern that enforced subject access requests not only represent an abuse of an individual’s rights but also potentially undermine important public policies.

Section 56 will prohibit a person from requiring an individual to produce certain records as a condition of employment or for providing a service, other than where the relevant record is required by law or where it is justified in the public interest.

These changes will not prevent employers from carrying out Disclosure and Barring Service checks in relation to the recruitment of employees to occupations covered by the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975. For jobs that do not fall within the exceptions, however, employers will risk a fine of £5,000 in the Magistrates Court or an unlimited fine in the Crown Court if they seek to force an applicant to provide their criminal record by making a subject access request.