What is an “Enforced Subject Access Request”?
Section 184 of the Data Protection Act 2018 creates a criminal offence known as “enforced subject access.”
It is occasionally misunderstood.
What Section 184 Actually Does
Section 184 makes it an offence for a person to:
- require another individual
- to make a Subject Access Request (SAR)
- and provide the results
- where the information sought is a “relevant record.”
A “relevant record” is narrowly defined as:
- A health record
- A record relating to criminal convictions or cautions
- Information obtained through a statutory function relating to such records
Both elements must be present:
- There must be a requirement (i.e. compulsion or coercion); and
- The information must be a “relevant record”.
If either element is absent, Section 184 is not engaged.
What Section 184 Does Not Do
Section 184:
- Is not a general prohibition on third-party SARs
- Does not prevent individuals from authorising representatives
- Does not apply to ordinary personal data
- Does not apply simply because disclosure may assist a contractual relationship
The ICO has consistently indicated that voluntary authorisation by a data subject does not amount to “enforced subject access”.
Third-Party Subject Access Requests
Under UK GDPR Article 15 and Part 3 of the DPA 2018:
- A data subject may authorise another person to act on their behalf
- The controller must verify identity and authority
- Lawful redaction may be applied where appropriate
There is no statutory requirement that the representative be “independent” or “impartial”.
Why This Matters
Section 184 was introduced to prevent employers or others from forcing individuals to obtain and disclose sensitive criminal or health records.
It was not designed to restrict voluntary exercises of statutory access rights.
Where misapplied, Section 184 can:
- Create unnecessary barriers to lawful access
- Generate regulatory disputes
- Cause delay and uncertainty
Clarity in interpretation benefits:
- Data subjects
- Public authorities
- Representatives
- Regulators
Current exchanges with Essex police and the ICO about TP SARs and s.184 can be found here. This page will be updated as regulatory consideration progresses.
West Midlands Police conduct & apology can be found here. This page will be updated as regulatory consideration progresses.