Bill to amend Data Protection Act 1998

Updated January 2009

The Coroners and Justice Bill, published on 14 January 2009 (the "Bill"), includes various proposals to amend the Data Protection Act 1998 ("DPA"). Key proposed amendments include:

Assessment notices for Government departments
Under the proposals, the Information Commissioner will have a new power to serve a Government Department or a designated Public Authority with an assessment notice to enable him to establish whether the Department or Public Authority has complied or is complying with the data protection principles. The service of an assessment notice will allow the Commissioner to enter premises, inspect or examine any documents, information, equipment or material and to observe the processing of any personal data that takes place on the premises. Although currently limited to Government departments and Public Authorities, it is likely that the Information Commissioner will continue to push to receive similar powers in relation to private organisations.

Information notices
It is also proposed to strengthen the Information Commissioner's powers to request information using an information notice. The Information Commissioner already has powers to issue an information notice requiring a data controller to provide information to enable the Information Commissioner to determine whether a data controller is complying with the data protection principles. Under the proposed amendments, the Information Commissioner will be able to specify particular information or categories of information to be provided, the time and place for the provision of information and the format in which information must be provided.

Information sharing orders
The Bill introduces a new power for designated authorities (broadly defined as Government Ministers, the Secretary of State and the Treasury) to serve an information sharing order, which will allow a person to share personal information for purposes other than that for which the information was collected. Information sharing orders may only be used if the designated authority is satisfied that information sharing is necessary to attain a policy objective, the information sharing is proportionate to the policy objective and strikes a fair balance between the public interest and any person affected by the information sharing.

Fee regulations
The Bill also includes amendments to enable tiered notification fee arrangements. At present an annual fee of £35 is payable by all data controllers. The Government's consultation last year indicated that the fee structure was likely to change so that larger organisations will pay a higher notification fee. The proposed structure of a tiered fee arrangement and the level of tiered fees has not yet been published. The amendments in the Bill require data controllers to provide information to verify the fee payable, which anticipates that a tiered fee structure will follow.

Comment
The proposals contained in the Bill contain few surprises. The most controversial proposal is the new right for designated Public Authorities to issue information sharing orders and we expect this to be the area that causes most debate as the Bill passes through Parliament. The Bill is likely to become law within a matter of months. We will update you as to the progress of the Bill as it passes through Parliament.