Data Protection Act 2018 (c. 12)

SCHEDULES

SCHEDULE 2 U.K. Exemptions etc from the [F1 UK GDPR]

Textual Amendments

F1 Words in Sch. 2 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

PART 3 U.K. Restriction [F2 for the] protection of rights of others

Textual Amendments

F2 Words in Sch. 2 Pt. 3 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(13) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Protection of the rights of others: general U.K.

16 (1) Article 15(1) to (3) of the [F3 UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers), and Article 5 of the [F3 UK GDPR] so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3), do not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information. U.K.

(2) Sub-paragraph (1) does not remove the controller's obligation where—

(a) the other individual has consented to the disclosure of the information to the data subject, or

(b) it is reasonable to disclose the information to the data subject without the consent of the other individual.

(3) In determining whether it is reasonable to disclose the information without consent, the controller must have regard to all the relevant circumstances, including—

(a) the type of information that would be disclosed,

(b) any duty of confidentiality owed to the other individual,

(c) any steps taken by the controller with a view to seeking the consent of the other individual,

(d) whether the other individual is capable of giving consent, and

(e) any express refusal of consent by the other individual.

(4) For the purposes of this paragraph—

(a) “information relating to another individual” includes information identifying the other individual as the source of information;

(b) an individual can be identified from information to be provided to a data subject by a controller if the individual can be identified from—

(i) that information, or

(ii) that information and any other information that the controller reasonably believes the data subject is likely to possess or obtain.

Textual Amendments

F3 Words in Sch. 2 para. 16(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(14) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)