Section 56 of the Data Protection Act 1998 will come into force on 10 March 2015.  It makes it a criminal offence for an employer, as a condition of employment, to require an employee or prospective employee to provide the employer with information obtained by means of a Subject Access Request (SAR) made under section 7 of the Act relating to his criminal convictions or cautions. 

This is known as enforced subject access and will typically occur where an employer wishes to see an employee’s or prospective employee’s criminal record but chooses not to use the established criminal records disclosure regime set out in the Police Act 1997. Under that regime, where it is legitimate to do so and the regime allows it, employers can make criminal records disclosure requests to the Disclosure and Barring Service in England and Wales for standard and enhanced checks and Disclosure Scotland for Scotland and for basic checks UK wide. The Information Commissioner’s Office has made clear that section 56 does not affect these legitimate criminal records checks.

An individual providing the results of a SAR, rather than using the appropriate channels set out above, runs the risk of greater and sometimes excessive disclosure. This is because a SAR requires all personal information to be disclosed (subject to some exemptions) and it does not distinguish between, for example, spent and unspent convictions.

It will not, however, be a criminal offence for an employer to request an individual to make a SAR for their personal data if there is other legislation in place which allows this to be done.

The criminal offence carries a potentially unlimited fine.