§ Harry CohenTo ask the Secretary of State for Foreign and Commonwealth Affairs how many times the revised certificate he signed last December with respect to Section 28 of the Data Protection Act 1998 has been used by the Intelligence Service and GCHQ in relation to(a) the right of access to personal data and (b) the disclosure of personal data to the Service or GCHQ; and if he will make a statement. [74481]
§ Mr. StrawThe certificates I signed pursuant to section 28 (2) of the Data Protection Act 1998 relating to SIS and GCHQ provide evidence that the exemption from those provisions of the Act that are specified in the certificate are required for the purpose of safeguarding national security. The certificates identify the personal data to which they apply by means of general528W descriptions and are expressed to have prospective effect, in accordance with section 28 (3). The certificates are used in the context of any legal challenge to the application of the section 28 exemption, such as appeals brought before the Information Tribunal under section 28 (4) or 28 (6). There have been no appeals against the certificate in respect of SIS and there have been two against the certificate in respect of GCHQ, which are still extant.
§ Harry CohenTo ask the Secretary of State for Foreign and Commonwealth Affairs how many subject access requests have been received by the Intelligence Service and GCHQ since the right of access afforded by the Data Protection Act 1998 came into effect; how many of these requests were from data subjects who were not employed or contracted to the Service; and whether any request for access has resulted in personal data being obtained by data subjects. [74480]
§ Mr. StrawThe Secret Intelligence Service has received 80 requests for subject access since the Data Protection Act 1998 came into force. Of those, 37 were from individuals not employed by or under contract to the Service. GCHQ has received 25 requests from individuals not employed by or under contract to GCHQ, of which 2 were from former employees. Personal data has been provided by both agencies to data subjects in both categories in response to requests in accordance with Section 7 of the Act.