A subject access request is a request by a data subject, normally an employee to a data controller, commonly the employer, for copies of all documents it holds and processes regarding that individual. The right has been around for a long time but the new s.56 of the Data Protection Act 1998 will prevent the employer using a subject access request to find out about an employee or prospective employee’s criminal records.
It is already acknowledged by the Information Commissioner’s Office (ICO), an organisation which governs the application of the Data Protection Act 1998 that this method can lead to the disclosure of spent convictions. It is therefore not considered good practice by the ICO and the Disclosure and Barring Service (DBS).
s.56 does not just apply in the employment context, it extends further than that and can apply in the provision of goods and services. A breach of this section is punishable by an unlimited fine.