Part VI: Historical records and records in Public Record Office or Public Record Office of Northern Ireland

Section 62: Interpretation of Part VI

200.     This section defines the expression "historical record" for the purpose of this Part of the Act. A historical record is a record which is thirty years old, counting from the calendar year following that in which it was created. Where records are kept in a file, the thirty years (and the other periods of years mentioned in section 63) are reckoned from the calendar year following that in which the most recent was created.

Section 63: Removal of exemptions: historical records generally

201.     The effect of this section is to disapply some of the exemptions in Part II of the Act in the case of information contained in a historical record, and therefore to extend the scope of the right of access in section 1 in these cases. The exemptions which are disapplied are those relating to:

• relations within the United Kingdom (section 28);

• criminal investigations and proceedings (section 30(1));

• court records, etc (section 32);

• audit functions (section 33);

• formulation of government policy etc (section 35);

• prejudice to effective conduct of public affairs (section 36);

• communications with Her Majesty etc (section 37(1)(a));

• legal professional privilege (section 42); and

• commercial interests (section 43).

202.     In addition, the exemption relating to honours (section 37(1)(b)) is disapplied in respect of information contained in a record which is 60 years old, and the law enforcement exemption (section 31) is disapplied in respect of information contained in a record which is one hundred years old.

Section 64: Removal of exemptions: historical records in public record offices

203.     This section makes further disapplication of exemptions in Part II of the Act in the case of information contained in a historical record, but only where the record is held by the Public Record Office. (The Public Record Office is a government department and so, by virtue of paragraph 1 of Schedule 1, a public authority for the purposes of the Act.) Corresponding provision for Northern Ireland is included.

204.     Under subsection (1), the exemption for information accessible to the public by other means does not apply in these cases. This is despite the fact that the Keeper of Public Records will continue to be under an obligation under section 5(3) of the Public Records Act 1958 to arrange reasonable facilities for public inspection and copies as well as complying with the duties under the Act. Nor does the exemption for information intended for future publication apply.

205.     Subsection (2) provides that, where information is held in a historical record in the Public Record Office, although the exemption relating to information supplied by, or relating to the work of, bodies dealing with national security matters will continue to apply, it will not be considered to be an absolute exemption for the purposes of section 2.

Section 65: Decisions as to refusal of discretionary disclosure of historical records

206.     This section applies where a public authority holds information contained in a historical record which is also a "public record" as defined by the Public Records Act 1958, and where that information is exempt information by virtue of a provision in Part II not specified as conferring absolute exemption in section 2(3). Section 65 provides that where the authority is minded to refuse a request for that information, it must consult the Lord Chancellor before doing so. Corresponding provision for Northern Ireland is included. Subsection (2) disapplies this section to information to which clause 66 applies.

Section 66: Decisions relating to certain transferred public records

207.     This section applies to information in a transferred public record which has not been designated by the responsible authority as open information for the purposes of this section. Section 66 provides that, before deciding whether any exemption applies in respect of the duty to confirm or deny, or the duty to disclose, the appropriate records authority (for example, the Public Record Office) must consult the responsible authority (which will generally be the authority who transferred the record to it).

208.     Subsections (3) and (4) provide that if the duty to confirm or deny, or the duty to disclose, does not arise, as a result of an exemption not specified in section 2 as conferring absolute exemption, then it will be for the responsible authority, not the public records authority, to make the public interest decisions regarding the duty to confirm or deny and disclosure. This is because it is the responsible authority which has the knowledge and expertise to enable them to make such decisions.

209.     Subsection (5) provides that the responsible authority must consult with the Lord Chancellor before determining that the public interest does not require disclosure. In the case of public records to which the Public Records Act (Northern Ireland) 1923 applies, consultation must be with the appropriate Northern Ireland Minister.

210.     Subsection (6) provides that if the responsible authority is not a public authority within the scope of the Act, then it will be treated as a public authority for the purposes of Parts III, IV and V of the Act, so far as relating to the duty in section 15(3) and the imposition of any requirement to provide information to which this section applies.

Section 67: Amendments of public records legislation

211.     This section introduces Schedule 5 which amends the Public Records Act 1958 to make provision consequential on the application of the Act to the Public Record Office and to create a power to extend the meaning of public records for the purposes of the 1958 Act.

Part VII: Amendments of Data Protection Act 1998

Sections 68 to 73

212.     Part VII of the Act has the effect that the Data Protection Act 1998 rights of subject access and data accuracy are extended to all personal information held by public authorities, with some modifications and exemptions.

213.     This is achieved by the device of providing that all personal information held by public authorities counts as personal data for the purposes of the 1998 Act, then cancelling all of the effects of that redefinition except those relating to subject access and accuracy (other than as regards personal information and non-designated functions of public authorities). Some modifications are made to the right of subject access as it relates to certain unstructured records.

214.     The Data Protection Act 1998 creates two important rights for individuals in respect of information which is personal to them. Individuals are entitled to be told whether personal information relating to them is being held (or otherwise processed) and, if so, to have both it and certain other details about it communicated to them. This is known as subject access. The 1998 Act also makes provision placing a duty of accuracy on all data controllers. In both cases, the 1998 Act makes the rights enforceable both in the courts and, as a regulatory matter, by the Commissioner. These rights are, however, limited by the terms of application of the Data Protection Act 1998 itself. In particular, the scope of that Act is limited by the key definitions set out in section 1(1), most importantly the definition of "data", which is restricted to information which is automated, or intended for automated processing, or part of a structured "relevant filing system" (as defined), or part of an "accessible record" (defined by section 68 of the 1998 Act to mean certain health, education, housing and social work records).

215.     Section 68 has the effect that, for public authorities within the terms of the Act, the limitations on the definition of "data" in s.1(1) of the 1998 Act disappear (except to the extent that the information relates to functions in respect of which, under section 7, the Act does not apply). Subject to that limitation, the 1998 Act therefore applies to any personal information held by a public authority. That means, specifically, that the Data Protection Act applies to public authorities' non-automated records even though they are not part of a "relevant filing system" and not part of an "accessible record" as defined in the Act. An example of that might be incidental personal information on a policy file, or in loose papers. The chief effect of this section for present purposes is that it achieves the extension of all the Data Protection Act provisions about subject access and accuracy to this new range of information. Section 1 of the 1998 Act, as amended by the Act, is set out as an Annex to these Notes.

216.     But subject access will work in a slightly modified way in this new area, and Section 69 introduces two important qualifications to the subject access right which are not found in the 1998 Act as it stands. Section 69 itself applies to only some of the personal information added to the scope of subject access by section 68. It does not apply to information recorded on paper which, although it is not part of a "relevant filing system" or part of an "accessible record", is nevertheless structured to a certain extent by reference to individuals. An example of such relatively structured information might be a case file about an individual which contains correspondence about a number of matters relating to that individual and is indexed by reference only to the dates of the correspondence. This relatively structured information will be treated for subject access purposes in exactly the same way as other personal information within the scope of the Data Protection Act. But two special rules will apply in respect of subject access to the residue, that is, the relatively unstructured information.

• Firstly, subject access will not be given to this information unless the information is expressly described in the request. A request from a data subject for access to his own personal data has to be met in general by giving access to all of that subject's data, without his having to specify any of it. No part of the residue of relatively unstructured personal information, however, will be included in response to a subject access request unless the data subject has expressly described it.

• Secondly, even where residual relatively unstructured personal information has been described, the authority will be able to rely on provisions equivalent to those set out in section 12 of the Act to refuse a request in so far as it relates to that information where to do so would cost more than is provided for by a prescribed cost ceiling.

218.     However, as well as achieving the expansion (and partial modification) of data subject rights, the amendment to the definition of "data" produced by section 68 would of course bring all the rest of the 1998 Act to bear on the totality of public authorities' personal information. Given that the new rights exist and are operated wholly within the context of the 1998 Act, the extension of the definition of "data" is a streamlined way of extending the key subject access and accuracy provisions. But the general application of the 1998 Act to all personal information held by public authorities is not an intended by-product, and the Act therefore needed to ensure that the excess application of the 1998 Act was cancelled out. That is what section 70 achieves. It strips out of the extension of the new definition of "data" all the substantive effects of the Data Protection Act 1998 except those relating to subject access and accuracy.

219.     Section 70 has one further effect. It provides that the extension of the rights of subject access and accuracy achieved in Part VII of the Act does not apply to personnel information held by public authorities.

220.     Section 71 amends section 16(1) of the Data Protection Act 1998 so as to require data controllers who are public authorities for the purposes of the Act to state that fact when making any notification under Part III of the 1998 Act. This information will then appear on the public register maintained under Part III of the 1998 Act.

221.     Section 72 amends section 34 of the Data Protection Act 1998. Section 34 provides that personal data are exempt from the Act's provisions relating to subject access and accuracy, and from certain other restrictions on disclosure, if they consist of information which is subject to a statutory duty to make it available to the public. That is because such statutory access provisions - such as those governing the Register of births, marriages and deaths or the Land Registry - make their own detailed arrangements for access, accuracy, and disclosure, which are accordingly made to prevail over the more general provisions of the 1998 Act. But the reference in section 34 to statutory obligations would be capable of including those in this Act, thus making this Act's regime predominate over that of the 1998 Act. This would not be consistent with this Act's express provision that, in the case of personal data, its own provisions are subject to the limits of the 1998 Act. Section 72 removes the inconsistency by providing that the reference to statutory obligations in section 34 of the 1998 Act is not to include those in this Act.

222.     Section 73 introduces Schedule 6 which contains further amendments to the 1998 Act.

Part VIII: Miscellaneous and supplemental

Section 74: Power to make provision relating to environmental information.

223.     This section provides that the Secretary of State may make regulations to implement the United Nations Economic Commission for Europe (UNECE) Convention on access to information, public participation in decision-making and access to justice in environmental matters, which the UK signed at Aarhus in 1998 (the Aarhus Convention), insofar as the Convention relates to the provision of access to environmental information.

224.     The regulations will form a free-standing regime, giving access to environmental information. Section 39 exempts environmental information which is available under the regulations from the main provisions of the Act.

225.     The regulations made under the power contained in this section will replace the current Environmental Information Regulations 1992 (SI 1992/3240), as amended by the Environmental Information (Amendment) Regulations 1998 (SI 1998/1447). These regulations implement Directive 90/313/EEC on the Freedom of Access to Information in the Environment.

226.     Subsection (3) gives the Secretary of State power to make regulations to implement those articles of the Aarhus Convention which relate to the provision of access to environmental information, or for the purpose of dealing with matters arising from them, or amendments to them.

227.     Subsection (4) permits the regulations to include provisions enabling charges to be made in connection with the disclosure of environmental information, and to give effect to any obligations the regulations may impose.

228.     Subsection (4) also permits certain provisions of the Act to be applied to the regulations, with modifications. The regulations may make provision for a code of practice to apply to bodies subject to the regulations and for the application of the Information Commissioner's powers under sections 47 and 48, as modified if necessary, to it. The regulations may also apply, with modifications, to Parts IV and V of the Act (dealing with enforcement and appeals), so that the Information Commissioner enforces the regulations and, as set out in Part V, with the Tribunal, considers any appeals relating to applications for environmental information under the regulations. The regulations may also make provision for any transitional or consequential provisions that are appropriate.

229.     Subsection (5) ensures that the regulations made under the section to implement the Aarhus Convention do not apply to the Scottish bodies referred to in section 80.

Section 75: Power to amend or repeal enactments prohibiting disclosure of information

230.     This section empowers the Secretary of State to make orders repealing or amending primary or secondary legislation which has the effect of prohibiting disclosure of information under the Act. These orders may remove or relax the prohibitions and they may also make consequential, incidental or transitional provision. Orders may make different provision for different cases and can only be made with the approval of both Houses of Parliament (section 82(2)).

Section 76: Disclosure of information between Commissioner and ombudsmen

231.     Subsection (1) allows the Commissioner to disclose to specified ombudsmen any information he has obtained or which has been given to him under or for the purposes of this Act or the Data Protection Act 1998, if it appears to him that the information in question relates to a matter which could be the subject of an investigation by one of the specified ombudsmen under the enactment relating to that ombudsman. The ombudsmen specified are: the Parliamentary Commissioner for Administration; the Health Service Commissioners for England, Wales and Scotland; Local Commissioners (as defined by section 23(2) of the Local Government Act 1974); the Commissioner for Local Administration in Scotland; the Scottish Parliamentary Commissioner for Complaints; the Welsh Administration Ombudsman; the Northern Ireland Commissioner for Complaints and the Assembly Ombudsman for Northern Ireland.

232.     In effect, the ability of the Commissioner to disclose information to the three Scottish ombudsmen will be limited to information about matters obtained by or given to him under the Data Protection Act 1998. This is because the Commissioner will not have information under this Act relating to bodies within the jurisdiction of the Scottish ombudsmen.

233.     Subsection (2) introduces Schedule 7, which provides for amendments to the relevant legislation to provide that the specified ombudsmen are empowered to disclose information to the Commissioner.

Section 77: Offence of altering etc. records with intent to prevent disclosure

234.     This section makes it an offence to alter, deface, block, erase, destroy or conceal records held by a public authority with the intention of preventing its disclosure to an applicant who has made a request for the information and is entitled to receive it. The offence applies to the public authority and anyone who is employed by, is an officer of, or is subject to the direction of, the public authority. A person found guilty of the offence is liable to a fine not exceeding level 5 on the standard scale (currently £5000). The offence cannot be committed by a government department but can be committed by civil servants.

Section 78: Saving for existing powers

235.     This section ensures that nothing in the Act limits existing powers of public authorities to disclose information held by them.

Section 79: Defamation

236.     This section provides that for the purposes of the law of defamation a disclosure under the Act is covered by qualified privilege, in cases where the information had been supplied to the public authority by a third person.

Section 80: Scotland

237.      This section provides that no order may be made under section 4(1) or 5 in respect of the Scottish Parliament, any part of the Scottish Administration, the Scottish Parliamentary Corporate Body or any Scottish public authority with mixed functions or no reserved functions within the meaning of the Scotland Act 1998. The power conferred by section 74(3) does not include power to make provision in relation to information held by these bodies. The Scottish Parliament has legislative competence in relation to freedom of information for these bodies.

Section 81: Application to government departments, etc

238.     This section ensures that each government department is a separate public authority for the purposes of the Act. However, that does not mean that a duty of confidence can be treated as arising between one government department and another.

Section 82: Orders and regulations

239.     This provides that any power of the Secretary of State to make an order or regulations under this Act shall be exercisable by statutory instrument. An order under each of the following provisions requires affirmative resolution procedure:-

• section 5 (designation of further public authorities);

• section 7(3) (amending Schedule 1) or (8) (excluded information);

• section 53(1)(a)(iii)(to designate a public authority as an authority excepted from the duty to comply with a decision or enforcement notice in accordance with section 53); or

• section 75 (power to amend or repeal enactments prohibiting disclosure of information); or

• regulations under section 10(4) (time for compliance); or

• section 74(3)(power to make provision relating to environmental information).

240.     An order under section 4(1) (amendments to Schedule 1 adding an entry) and regulations made under any other provision of the Act are subject to annulment in pursuance of a resolution of either House.

241.     An order under section 4(5) (amendments to Schedule 1 removing an entry) has to be laid before Parliament after being made.

242.     By virtue of subsection (5), a draft order under section 5 or 7(8) which would otherwise attract the procedure applicable to hybrid instruments will not do so.

Section 83: Meaning of a "Welsh public authority"

243.     This section defines a "Welsh public authority" as any public authority listed in Parts II, III, IV or VI of Schedule 1, and whose functions are exercisable only or mainly in or as regards Wales, other than an excluded authority, or any public authority which is an Assembly subsidiary as defined by section 99(4) of the Government of Wales Act 1998. Subsections (2) and (3) provide that an "excluded authority" means one which has been designated for the purpose of this section by order of the Secretary of State, after consultation with the National Assembly for Wales.

Section 85: Expenses

244.     This authorises any increase attributable to the Act in expenditure which is payable out of money provided by Parliament.

Section 87: Commencement

245.     Subsection (1) provides for the immediate commencement on Royal Assent of:

• sections 3 to 8 (the definition of 'public authority', power to add bodies to Schedule 1, power to designate further public authorities, defining publicly-owned companies and public authorities to which the Act has limited application, definition of request for information) and Schedule 1;

• sections 19 and 20 (allowing the approval of publication schemes by the Commissioner and the drafting of model publication schemes);

• section 47(2) to (6) (empowering the Commissioner to carry out his general functions under the Act);

• section 49 (requiring the Commissioner to lay reports before Parliament);

• section 74 (power to make provision relating to environmental information);

• section 75 (power to amend or repeal enactments prohibiting disclosure of information);

• sections 78 to 85 (saving for existing powers, defamation, application to Scotland and to government departments, orders and regulations made under the Act, meaning of a "Welsh public authority", interpretation and expenses);

• section 87 (commencement);

• paragraph 4 of Schedule 5 (enabling bodies to be added to the Table in paragraph 3 of Schedule 1 of the Public Records Act 1958) and section 67 so far as it relates to that paragraph;

• those parts of Schedule 6 relating to Schedule 14 of the Data Protection Act 1998 and section 73 so far as it relates to those parts and Part 1 of Schedule 8 (which repeals part of Schedule 14 to the Data Protection Act 1998) and section 86 so far as it relates to that Part.

247.     Subsection (2) provides for the coming into force two months after Royal Assent (ie on 30th January 2001) of the provisions providing that the Data Protection Commissioner is to be known as the Information Commissioner and those that make consequential changes in related legislation.

248.     Subsections (3) and (4) provide that all other provisions must come into force within five years after Royal Assent unless they have already been brought into force, provide flexibility to have different commencement dates for different purposes within the five year period, and allow for savings and transitional provision to be made, including provision capable of having effect after the five year period.

249.     Subsection (5) requires the Secretary of State to lay before Parliament annual reports on his proposals for commencement of those parts of the Act not yet fully in force, until such time as the Act is fully commenced in accordance with subsection (3).

Schedules

Schedule 1: Public authorities

250.     This Schedule lists "public authorities" for the purposes of the Act. Government departments, the Houses of Parliament, the Northern Ireland Assembly, the National Assembly for Wales, the armed forces, local government bodies, National Health Service bodies, schools, colleges and universities, police authorities and Chief Officers of Police and other public bodies and offices are all specified as public authorities. Further persons, bodies or office holders may be designated by order under sections 4 and 5.

Schedule 2: The Commissioner and the Tribunal

Part I: Provision consequential on section 18(1) and (2)

251.     Part I makes provision required as a consequence of the renaming of the Data Protection Commissioner and Data Protection Tribunal. Paragraphs 1 and 2 make general provision in connection with the changing of the names of the Commissioner and the Tribunal. Specific amendments are made to:

• Public Records Act 1958

• Parliamentary Commissioner Act 1967

• Superannuation Act 1972

• Consumer Credit Act 1974

• House of Commons Disqualification Act 1975

• Northern Ireland Assembly Disqualification Act 1975

• Tribunals and Inquiries Act 1992

• Judicial Pensions and Retirement Act 1993

• Data Protection Act 1998

Part II: Amendments relating to extension of functions of Commissioner and Tribunal

252.     This Part makes minor substantive amendments to the institutional provisions of the Data Protection Act 1998.

253.     Paragraph 16 amends section 6 of the 1998 Act to require lay members of the Tribunal to include persons representing applicants for information under this Act and persons to represent the interests of public authorities.

254.     Paragraph 17 amends section 26(2) of the 1998 Act to ensure that in prescribing notification fees the Secretary of State is to have regard to the expenses of the Commissioner and Tribunal under the 1998 Act only, and not their expenses under this Act.

255.     Paragraph 18 amends section 58 of the 1998 Act to provide that information may be passed to the Commissioner or Tribunal to allow them to discharge their freedom of information functions.

256.     Paragraph 19 amends section 59 of the 1998 Act to provide that the duty of confidentiality on the Commissioner, his staff and agents and the related offence under the 1998 Act apply also in respect of information obtained by or furnished to the Commissioner under this Act.

257.     Paragraph 20 amends Schedule 5 to the 1998 Act to allow the Commissioner to appoint a second deputy commissioner and states that, if two are appointed, the Commissioner should specify the functions of each.

258.     Paragraph 21 amends Schedule 5 to the 1998 Act to enable both deputy commissioners to perform the functions of the Commissioner in relation to freedom of information as well as data protection in the event of a vacancy in the Commissioner post or when the Commissioner is unable to act.

259.     Paragraph 22 amends paragraph 9(1) of Schedule 5 to the 1998 Act to provide that the Commissioner's funding regime, set up in respect of his functions under the Data Protection Act 1998 and consumer credit legislation, applies also in respect of his freedom of information functions.