2(1)In this Part of this Schedule—
“the appropriate health professional”, in relation to a question as to whether the serious harm test is met with respect to data concerning health, means—
the health professional who is currently or was most recently responsible for the diagnosis, care or treatment of the data subject in connection with the matters to which the data relates,
where there is more than one such health professional, the health professional who is the most suitable to provide an opinion on the question, or
a health professional who has the necessary experience and qualifications to provide an opinion on the question, where—
there is no health professional available falling within paragraph (a) or (b), or
the controller is the Secretary of State and data is processed in connection with the exercise of the functions conferred on the Secretary of State by or under the Child Support Act 1991 and the Child Support Act 1995, or the Secretary of State’s functions in relation to social security or war pensions, or
the controller is the Department for Communities in Northern Ireland and data is processed in connection with the exercise of the functions conferred on the Department by or under the Child Support (Northern Ireland) Order 1991 (S.I. 1991/2628 (N.I. 23)) and the Child Support (Northern Ireland) Order 1995 (S.I. 1995/2702 (N.I. 13));
“war pension” has the same meaning as in section 25 of the Social Security Act 1989 (establishment and functions of war pensions committees).
(2)For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to data concerning health if the application of Article 15 of the GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
3(1)The listed GDPR provisions do not apply to data concerning health if—
(a)it is processed by a court,
(b)it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and
(c)in accordance with those rules, the data may be withheld by the court in whole or in part from the data subject.
(2)Those rules are—
(b)the Magistrates’ Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));
(c)the Family Proceedings Rules (Northern Ireland) 1996 (S.R. (N.I.) 1996 No. 322);
(e)the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));
(f)the Sheriff Court Adoption Rules 2009;
(g)the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));
4(1)This paragraph applies where a request for data concerning health is made in exercise of a power conferred by an enactment or rule of law and—
(a)in relation to England and Wales or Northern Ireland, the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject,
(b)in relation to Scotland, the data subject is an individual aged under 16 and the person making the request has parental responsibilities for the data subject, or
(c)the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.
(2)The listed GDPR provisions do not apply to data concerning health to the extent that complying with the request would disclose information—
(a)which was provided by the data subject in the expectation that it would not be disclosed to the person making the request,
(b)which was obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed, or
(c)which the data subject has expressly indicated should not be so disclosed.
(3)The exemptions under sub-paragraph (2)(a) and (b) do not apply if the data subject has expressly indicated that he or she no longer has the expectation mentioned there.
5(1)Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to data concerning health to the extent that the serious harm test is met with respect to the data.
(2)A controller who is not a health professional may not rely on sub-paragraph (1) to withhold data concerning health unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is met with respect to the data.
(3)An opinion does not count for the purposes of sub-paragraph (2) if—
(a)it was obtained before the beginning of the relevant period, or
(b)it was obtained during that period but it is reasonable in all the circumstances to re-consult the appropriate health professional.
(4)In this paragraph, “the relevant period” means the period of 6 months ending with the day on which the opinion would be relied on.
6(1)Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the disclosure of data concerning health by a controller who is not a health professional unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is not met with respect to the data.
(2)Sub-paragraph (1) does not apply to the extent that the controller is satisfied that the data concerning health has already been seen by, or is within the knowledge of, the data subject.
(3)An opinion does not count for the purposes of sub-paragraph (1) if—
(a)it was obtained before the beginning of the relevant period, or
(b)it was obtained during that period but it is reasonable in all the circumstances to re-consult the appropriate health professional.
(4)In this paragraph, “the relevant period” means the period of 6 months ending with the day on which the opinion would be relied on.