Exempt processing
2.—(1) For the purposes of regulation 2(1), processing of personal data is exempt processing if it—
(a)falls within one or more of the descriptions of processing set out in sub-paragraph (2), or
(b)does not fall within one or more of those descriptions solely by virtue of the fact that disclosure of the personal data is made for one of the reasons set out in sub-paragraph (3).
(2) The processing is—
(a)of personal data which is not being processed wholly or partly by automated means or recorded with the intention that it should be processed wholly or partly by automated means;
(b)undertaken by a data controller for the purposes of their personal, family or household affairs, including—
(i)the processing of personal data for recreational purposes, and
(ii)the capturing of images, in a public space, containing personal data;
(c)for the purpose of the maintenance of a public register;
(d)for the purposes of matters of administration in relation to the members of staff and volunteers of, or persons working under any contract for services provided to, the data controller;
(e)for the purposes of advertising, marketing and public relations in respect of the data controller’s business, activity, goods or services;
(f)subject to sub-paragraph (4), for the purposes of—
(i)keeping accounts, or records of purchases, sales or other transactions,
(ii)deciding whether to accept any person as a customer or supplier, or
(iii)making financial or financial management forecasts,
in relation to any activity carried on by the data controller;
(g)carried out by a body or association which is not established or conducted for profit and which carries out the processing for the purposes of establishing or maintaining membership or support for the body or association, or providing or administering activities for individuals who are either a member of the body or association or who have regular contact with it; or
(h)carried out by—
(i)a judge, or
(ii)a person acting on the instructions, or on behalf, of a judge,
for the purposes of exercising judicial functions including the functions of appointment, discipline, administration or leadership of judges.
(3) The disclosure is—
(a)required by or under any enactment, by any rule of law or by the order of a court;
(b)made for the purposes of—
(i)the prevention or detection of crime,
(ii)the apprehension or prosecution of offenders, or
(iii)the assessment or collection of any tax or duty or of any imposition of a similar nature,
and not otherwise being able to make the disclosure would be likely to prejudice any of the matters in (i) to (iii) above;
(c)necessary—
(i)for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), or
(ii)for the purposes of obtaining legal advice,
or is otherwise necessary for the purposes of establishing, exercising or defending legal rights; or
(d)required for the purpose of avoiding an infringement of the privileges of either House of Parliament.
(4) The processing of personal data by or obtained from a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974(1)) does not fall within the description of processing set out in sub-paragraph (2)(f).
1974 c. 39. Section 145(8) was substituted by S.I 2013/1881, art. 20(1) and (41)(g).