By Eduardo Ustaran

Legislative proposals—inspection powers and data sharing

UK data protection law is getting ready for the most significant changes since the passing of the Data Protection Act 11 years ago. The changes, which are currently being debated in Parliament, are aimed at strengthening the inspection powers of the Information Commissioner whilst facilitating the sharing of personal information. The Coroners and Justice Bill contains the right for the commissioner to serve an ‘assessment notice’ on a government department or a designated public authority. Essentially, the notice requires the recipient to assist the commissioner in his investigation by permitting the commissioner to enter its premises and examine any documents, hardware, or procedures for the purpose of conducting its investigation.

The bill also includes information-sharing provisions, which have generated some controversy, with some observers suggesting that the provisions represent an unwarranted interference with the privacy of personal information. The proposal permits a ‘designated authority’ to make an ‘information-sharing order’ to ‘enable any person to share information which consists of or includes personal data.’ A ‘designated authority’ is defined as the Secretary of State, the Treasury, ‘any other Minister in charge of a government department,’ and Scottish or Welsh Ministers or a Northern Ireland department.

The bill includes other provisions aimed at strengthening the safeguards for individuals in the event of an information-sharing order; in particular, the right for the commissioner to submit a report to Parliament when an information-sharing order is introduced. This measure has been welcomed by the commissioner, who would also be required to prepare a data-sharing code of practice providing practical guidance to organisations on the sharing of personal data in accordance with the requirements of the Data Protection Act. The commissioner welcomes this requirement but suggests that the final legislation should make it clear that organisations that are subject to an information-sharing order must take the code of practice into account.