SCHEDULES
SCHEDULE 3 Conditions relevant for purposes of the first principle: processing of sensitive personal data
1
The data subject has given his explicit consent to the processing of the personal data.
I12
1
The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment.
2
The F1 Secretary of State may by order—
a
exclude the application of sub-paragraph (1) in such cases as may be specified, or
b
provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.
3
The processing is necessary—
a
in order to protect the vital interests of the data subject or another person, in a case where—
i
consent cannot be given by or on behalf of the data subject, or
ii
the data controller cannot reasonably be expected to obtain the consent of the data subject, or
b
in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld.
4
The processing—
a
is carried out in the course of its legitimate activities by any body or association which—
i
is not established or conducted for profit, and
ii
exists for political, philosophical, religious or trade-union purposes,
b
is carried out with appropriate safeguards for the rights and freedoms of data subjects,
c
relates only to individuals who either are members of the body or association or have regular contact with it in connection with its purposes, and
d
does not involve disclosure of the personal data to a third party without the consent of the data subject.
5
The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.
6
The processing—
a
is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),
b
is necessary for the purpose of obtaining legal advice, or
c
is otherwise necessary for the purposes of establishing, exercising or defending legal rights.
C1I27
1
The processing is necessary—
a
for the administration of justice,
F2aa
for the exercise of any functions of either House of Parliament,
b
for the exercise of any functions conferred on any person by or under an enactment, or
c
for the exercise of any functions of the Crown, a Minister of the Crown or a government department.
2
The F3 Secretary of State may by order—
a
exclude the application of sub-paragraph (1) in such cases as may be specified, or
b
provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.
F67A
1
The processing—
a
is either—
i
the disclosure of sensitive personal data by a person as a member of an anti-fraud organisation or otherwise in accordance with any arrangements made by such an organisation; or
ii
any other processing by that person or another person of sensitive personal data so disclosed; and
b
is necessary for the purposes of preventing fraud or a particular kind of fraud.
2
In this paragraph “an anti-fraud organisation” means any unincorporated association, body corporate or other person which enables or facilitates any sharing of information to prevent fraud or a particular kind of fraud or which has any of these functions as its purpose or one of its purposes.
F77B
The processing is necessary for the purposes of making a disclosure in good faith under a power conferred by—
a
section 21CA of the Terrorism Act 2000 (disclosures between certain entities within regulated sector in relation to suspicion of commission of terrorist financing offence or for purposes of identifying terrorist property), or
b
section 339ZB of the Proceeds of Crime Act 2002 (disclosures within regulated sector in relation to money laundering suspicion).
8
1
The processing is necessary for medical purposes and is undertaken by—
a
a health professional, or
b
a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.
2
In this paragraph “medical purposes” includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.
I39
1
The processing—
a
is of sensitive personal data consisting of information as to racial or ethnic origin,
b
is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons of different racial or ethnic origins, with a view to enabling such equality to be promoted or maintained, and
c
is carried out with appropriate safeguards for the rights and freedoms of data subjects.
2
The F4 Secretary of State may by order specify circumstances in which processing falling within sub-paragraph (1)(a) and (b) is, or is not, to be taken for the purposes of sub-paragraph (1)(c) to be carried out with appropriate safeguards for the rights and freedoms of data subjects.
I410
The personal data are processed in circumstances specified in an order made by the F5 Secretary of State for the purposes of this paragraph.