Section 72: Data protection rules
238.This section inserts a new paragraph in Schedule 3 to the Data Protection Act 1998 to allow processing of sensitive personal data through an anti-fraud organisation. The processing must be necessary for the purposes of preventing fraud. Schedule 3 to that Act sets out additional conditions, one of which must be satisfied where the personal data that is being processed is sensitive personal data (as defined by section 2 of that Act). That expression includes information as to the commission or alleged commission of an offence by the data subject. Sub-paragraph (2) defines “anti-fraud organisation” for the purposes of this paragraph. The new paragraph is not limited to sensitive personal data that is processed pursuant to section 68 and includes disclosure of information under common law or other powers. The anti-fraud organisation does not need to be specified under that section.