PART 2General processing
CHAPTER 2F1 The UK GDPR
Special categories of personal data
I110Special categories of personal data and criminal convictions etc data
1
Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the F2UK GDPR (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—
a
point (b) (employment, social security and social protection);
b
point (g) (substantial public interest);
c
point (h) (health and social care);
d
point (i) (public health);
e
point (j) (archiving, research and statistics).
2
The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the F3UK GDPR for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.
3
The processing meets the requirement in point (g) of Article 9(2) of the F4UK GDPR for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.
4
Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.
5
The processing meets the requirement in Article F510(1) of the UK GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.
6
The Secretary of State may by regulations—
a
amend Schedule 1—
i
by adding or varying conditions or safeguards, and
ii
by omitting conditions or safeguards added by regulations under this section, and
b
consequentially amend this section.
7
Regulations under this section are subject to the affirmative resolution procedure.
11Special categories of personal data etc: supplementary
1
For the purposes of Article 9(2)(h) of the F6UK GDPR (processing for health or social care purposes etc), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the F6UK GDPR (obligation of secrecy) include circumstances in which it is carried out—
a
by or under the responsibility of a health professional or a social work professional, or
b
by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.
2
In Article 10 of the F7UK GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to—
a
the alleged commission of offences by the data subject, or
b
proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.
Pt. 2 Ch. 2 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 7 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)