SCHEDULE 1Special categories of personal data and criminal convictions etc data

PART 1Conditions relating to employment, health and research etc

Employment, social security and social protection

1(1)This condition is met if—

(a)the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection, and

(b)when the processing is carried out, the controller has an appropriate policy document in place (see paragraph 39 in Part 4 of this Schedule).

(2)See also the additional safeguards in Part 4 of this Schedule.

(3)In this paragraph—

Health or social care purposes

2(1)This condition is met if the processing is necessary for health or social care purposes.

(2)In this paragraph “health or social care purposes” means the purposes of—

(a)preventive or occupational medicine,

(b)the assessment of the working capacity of an employee,

(c)medical diagnosis,

(d)the provision of health care or treatment,

(e)the provision of social care, or

(f)the management of health care systems or services or social care systems or services.

(3)See also the conditions and safeguards in Article 9(3) of the GDPR (obligations of secrecy) and section 11(1).

Public health

3This condition is met if the processing—

(a)is necessary for reasons of public interest in the area of public health, and

(b)is carried out—

(i)by or under the responsibility of a health professional, or

(ii)by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.

Research etc

4This condition is met if the processing—

(a)is necessary for archiving purposes, scientific or historical research purposes or statistical purposes,

(b)is carried out in accordance with Article 89(1) of the GDPR (as supplemented by section 19), and

(c)is in the public interest.