The Data Protection (Subject Access Modification) (Health) Order 1987

Made: 9th November 1987

Coming into force: 11th November 1987

Now, therefore, in exercise of the powers conferred upon me by section 29(1) and (3) of the Data Protection Act 1984 [^f00001] and after consultation with the Data Protection Registrar in accordance with section 40(3) of that Act, I hereby make the following Order:

1

This Order may be cited as the Data Protection (Subject Access Modification) (Health) Order 1987 and shall come into force on 11th November 1987.

2

In this Order—

• “the Act” means the Data Protection Act 1984;

• “care” includes examination, investigation and diagnosis;

• “dental practitioner” and “medical practitioner” mean, respectively, a person registered under the Dentists Act 1984 [^f00002] and the Medical Act 1983 [^f00003];

• “health authority” has the same meaning as in section 128(1) of the National Health Service Act 1977 [^f00004];

• “Health Board” has the same meaning as in section 108(1) of the National Health Service (Scotland) Act 1978 [^f00005];

• “Health and Social Services Board” has the same meaning as in Article 16 of the Health and Personal Social Services (Northern Ireland) Order 1972 [^f00006];

• “health professional” means any person listed in the Schedule to this Order; and “the subject access provisions” has the meaning which it has for the purposes of Part IV of the Act.

3

• (1) This Order applies to personal data consisting of information as to the physical or mental health of the data subject if—

• (a) the data are held by a health professional; or

• (b) the data are held by a person other than a health professional but the information constituting the data was first recorded by or on behalf of a health professional.

• (2) This Order is without prejudice to any exemption from the subject access provisions contained in any provision of the Act or of any Order made under the Act.

4

• (1) The subject access provisions shall not have effect in relation to any personal data to which this Order applies in any case where either of the requirements specified in paragraph (2) below is satisfied with respect to the information constituting the data and the obligations contained in paragraph (5) below are complied with by the data user.

• (2) The requirements referred to in paragraph (1) above are that the application of the subject access provisions—

• (a) would be likely to cause serious harm to the physical or mental health of the data subject; or

• (b) would be likely to disclose to the data subject the identity of another individual (who has not consented to the disclosure of the information) either as a person to whom the information or part of it relates or as the source of the information or enable that identity to be deduced by the data subject either from the information itself or from a combination of that information and other information which the data subject has or is likely to have.

• (3) Paragraph (2) above shall not be construed as excusing a data user—

• (a) from supplying the information sought by the request for subject access where the only individual whose identity is likely to be disclosed or deduced as mentioned in sub-paragraph (b) thereof is a health professional who has been involved in the care of the data subject and the information relates to him or he supplied the information in his capacity as a health professional; or

• (b) from supplying so much of the information sought by the request as can be supplied without causing serious harm as mentioned in sub-paragraph (a) thereof or enabling the identity of another individual to be disclosed or deduced as mentioned in sub-paragraph (b) thereof, whether by the omission of names or other particulars or otherwise.

• (4) In relation to data to which this Order applies, section 21 of the Act shall have effect as if subsections (4)(b) and (5) were omitted and as if the reference in subsection (6) to the consent referred to in the said section 21 (4)(b) were a reference to the consent referred to in paragraph (2)(b) above.

• (5) A data user who is not a health professional shall not supply information constituting data to which this Order applies in response to a request under section 21 and shall not withhold any such information on the ground that one of the requirements specified in paragraph (2) above is satisfied with respect to the information unless the data user has first consulted the person who appears to the data user to be the appropriate health professional on the question whether either or both of those requirements is or are so satisfied.

• (6) In paragraph (5) above “the appropriate health professional” means—

• (a) the medical practitioner or dental practitioner who is currently or was most recently responsible for the clinical care of the data subject in connection with the matters to which the information which is the subject of the request relates; or

• (b) where there is more than one such practitioner, the practitioner who is the most suitable to advise on the matters to which the information which is the subject of the request relates; or

• (c) where there is no practitioner available falling within sub-paragraph (a) or (b) above, a health professional who has the necessary experience and qualifications to advise on the matters to which the information which is the subject of the request relates.

• (7) Section 21(8) of the Act shall have effect, in relation to data to which this Order applies, as if the reference therein to a contravention of the foregoing provisions of that section included a reference to a contravention of the provisions contained in this Article.

SCHEDULE — HEALTH PROFESSIONALS

Signed

Home Office

Douglas Hurd — One of Her Majesty’s Principal Secretaries of State — 9th November 1987

Explanatory note

(This note is not part of the Order)

This Order provides for the partial exemption from the provisions of the Data Protection Act 1984 which confer rights on data subjects to gain access to data held about them (“the subject access provisions”) of data relating to the physical or mental health of the data subject held by any data user where the data are held by a health professional or the information constituting the data was first recorded by or on behalf of a health professional. Schedule 1 to the Order lists the persons who are health professionals for the purposes of the Order.

The subject access provisions are disapplied only where to supply the data subject with particulars of the information constituting the data would be likely to cause serious harm to his physical or mental health or lead to the identification of another person (other than a health professional who has been involved in the care of the data subject). Before deciding whether either of those criteria is met (and, accordingly, whether to grant or withhold subject access) a data user who is not a health professional is obliged by the Order to consult the medical practitioner or dental practitioner responsible for the clinical care of the data subject or, if there is more than one, the most suitable available medical or dental practitioner or if there is none available a health professional who has the necessary experience and qualifications to advise on the matters to which the information which is requested relates.

Footnotes

[^f00001]: 1984 c. 35

[^f00002]: 1984 c. 24

[^f00003]: 1983 c. 54

[^f00004]: 1977 c. 49. This definition was amended by Schedule 3 to 1984 c. 48

[^f00005]: 1978 c. 29

[^f00006]: S.I. 1972/1265 (N.I. 14.).

[^f00007]: 1983 c. 54

[^f00008]: 1984 c. 24

[^f00009]: 1958 c. 32

[^f00010]: 1954 c. 61

[^f00011]: S.I. 1976/1213 (N.I.22).

[^f00012]: 1979 c. 36

[^f00013]: 1960 c. 66. Section 1(2) was amended by S.I. 1966/990 and 1986/630