Extension of the Information Commissioner’s powers under the Data Protection Act 1998

This consultation paper sets out our proposal to extend the powers of the Information Commissioner (ICO) to carry out compulsory assessments of NHS bodies’ compliance with the Data Protection Act 1998 and its data protection principles. It seeks views from data controllers in the health service and in health and social care across the United Kingdom.

The proposals are informed by the Information Commissioner’s experience working with NHS bodies to improve their compliance with data protection law.