Data Protection Act 2018

Exemption from the listed GDPR provisions: data subject's expectations and wishes U.K.

4 (1) This paragraph applies where a request for data concerning health is made in exercise of a power conferred by an enactment or rule of law and— U.K.

(a) in relation to England and Wales or Northern Ireland, the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject,

(b) in relation to Scotland, the data subject is an individual aged under 16 and the person making the request has parental responsibilities for the data subject, or

(c) the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.

(2) The listed GDPR provisions do not apply to data concerning health to the extent that complying with the request would disclose information—

(a) which was provided by the data subject in the expectation that it would not be disclosed to the person making the request,

(b) which was obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed, or

(c) which the data subject has expressly indicated should not be so disclosed.

(3) The exemptions under sub-paragraph (2)(a) and (b) do not apply if the data subject has expressly indicated that he or she no longer has the expectation mentioned there.