Section 184 makes it a criminal offence to require someone to make a subject access request (SAR) to get information about themselves, so that the requester (someone else) can see that information. This is ‘enforced subject access.’
Section 184(1):
“It is an offence for a person to require another person to provide a relevant record in connection with—
- (a) the recruitment of another person as an employee,
- (b) the continued employment of another person, or
- (c) any contract for the provision of services to him.”
Section 184(8) (definition of relevant record):
A relevant record is personal data that is:
- (a) processed for the purposes of, or
- (b) obtained from a person with access to, criminal conviction or health information.
Two-part legal test
For a crime to be committed under Section 184, both of these must be true:
- A requirement is made (someone is forced, compelled, pressured, etc.)
AND
- The required information is a “relevant record” (i.e. criminal conviction data or health data)
If one part is missing, no offence is committed.
For example, if an employer says: “Please request your school attendance records and show them to us.” Even if this is a requirement, it is not criminal or health data, so Section 184 DOES NOT apply.
Section 184 is narrow and specific. It is not a general ban on asking people to get information about themselves. It only applies if:
- They are being required to do so, AND
- The data in question is criminal record data or medical information
If the data is something else, like employment history, academic qualifications, or address history, Section 184 does not apply, even if the request is compulsory.
See also: