Parliamentary privilege does not exempt Members of Parliament (MPs) from complying with the Data Protection Act (DPA) with respect to constituency casework, and the requirements of the Act must therefore be observed.

An MP is the data controller for all personal data that is handled by their office and they have overall responsibility for ensuring that this is done in accordance with the DPA. Everyone who deals with personal information in an MP’s office has responsibility for the personal data that they handle for the MP, and must therefore comply with the rules of the DPA.

Consent for MPs to handle personal data

Consent from the subject of personal data is one condition that can allow an MP to handle personal data. It is often implied when a constituent contacts an MP and asks for assistance that they want their MP to use their information, as appropriate, in order to assist them in the issue they have contacted the MP about. Where this is clearly the case, an MP can handle the case without asking the constituent to specify their consent.

Consent for MPs to handle sensitive personal data

Explicit consent from the subject of personal data is one condition that allows sensitive personal data to be handled. MPs, however, do not always need to seek explicit consent to handle sensitive personal data in the course of constituency casework, as there is another condition (the ‘Elected Representatives condition’) which allows MPs to handle sensitive personal data in the circumstances outlined below.

Handling sensitive personal data about a constituent when the constituent has contacted the MP

The ‘Elected Representatives condition’ allows MPs to handle sensitive personal data in order to take action in connection with requests from individuals, without having to obtain explicit, written consent from that individual.

Handling information about a constituent when the constituent has not contacted the MP (third party correspondence)

When we receive personal information which is given to us by someone other than the subject of the information, we need to satisfy ourselves that it is acceptable to hold or use that information. For example, sometimes someone may send us information about a friend or relative and ask the MP to act for them.

As a general principle, we will need to ascertain the wishes of the person concerned. If it is not possible or appropriate to seek the views of the constituent, the ‘Elected Representatives condition’ allows the MP to act without that person’s consent in certain circumstances:

• If the constituent cannot give, or be expected to give, consent. For example, if a constituent has been charged with an offence while on holiday abroad. Their family might ask an elected representative to intervene urgently to help them to get home – but it might be difficult to gain their consent, particularly if they have no access to a telephone.

• Seeking consent would prejudice the action needed to be taken. For example, if the matter relates to a complaint that a constituent is committing benefit fraud.

• The action is necessary in the interests of another individual, and consent has been unreasonably withheld. For example, if an individual requires assistance in caring for their parent as the burden of caring is putting the individual at risk of ill-health, and that parent refuses to give consent.

Consent for other organisations to release personal data to an MP for the purpose of casework

The ‘Elected Representatives condition’ allows third parties (such as Government Departments or local authorities) to disclose sensitive personal data to an MP who is acting at the request of individuals where the data are relevant to the MP’s request and the disclosure is necessary to respond to the MP’s request. The ‘Elected Representatives condition’ is permissive; it does not compel third parties to disclose information to an MP.

Definitions

• Personal data is information about an identifiable living individual. This will include any information which has been anonymised, but where the individual could still be identified by other information that the MP can access. The information may be held electronically. It also includes information in manual e.g by filing system alphabetised by peoples’ names.

• Sensitive personal data is information regarding an individual’s racial or ethnic origin; political opinions; religions or similar beliefs; trade union membership; physical/mental health or condition; sexual life; offences committed or alleged to have been committed; proceedings for any alleged or committed offence and the resulting disposal or court sentence.