6(1)Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the disclosure of data concerning health by a controller who is not a health professional unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is not met with respect to the data.
(2)Sub-paragraph (1) does not apply to the extent that the controller is satisfied that the data concerning health has already been seen by, or is within the knowledge of, the data subject.
(3)An opinion does not count for the purposes of sub-paragraph (1) if—
(a)it was obtained before the beginning of the relevant period, or
(b)it was obtained during that period but it is reasonable in all the circumstances to re-consult the appropriate health professional.
(4)In this paragraph, “the relevant period” means the period of 6 months ending with the day on which the opinion would be relied on.