4.—(1) The subject access provisions shall not have effect in relation to any personal data to which this Order applies in any case where either of the requirements specified in paragraph (2) below is satisfied with respect to the information constituting the data and the obligations contained in paragraph (5) below are complied with by the data user.

(2) The requirements referred to in paragraph (1) above are that the application of the subject access provisions—

(a) would be likely to cause serious harm to the physical or mental health of the data subject; or

(b) would be likely to disclose to the data subject the identity of another individual (who has not consented to the disclosure of the information) either as a person to whom the information or part of it relates or as the source of the information or enable that identity to be deduced by the data subject either from the information itself or from a combination of that information and other information which the data subject has or is likely to have.

(3) Paragraph (2) above shall not be construed as excusing a data user—

(a) from supplying the information sought by the request for subject access where the only individual whose identity is likely to be disclosed or deduced as mentioned in sub-paragraph (b) thereof is a health professional who has been involved in the care of the data subject and the information relates to him or he supplied the information in his capacity as a health professional; or

(b) from supplying so much of the information sought by the request as can be supplied without causing serious harm as mentioned in sub-paragraph (a) thereof or enabling the identity of another individual to be disclosed or deduced as mentioned in sub-paragraph (b) thereof, whether by the omission of names or other particulars or otherwise.

(4) In relation to data to which this Order applies, section 21 of the Act shall have effect as if subsections (4)(b) and (5) were omitted and as if the reference in subsection (6) to the consent referred to in the said section 21 (4)(b) were a reference to the consent referred to in paragraph (2)(b) above.

(5) A data user who is not a health professional shall not supply information constituting data to which this Order applies in response to a request under section 21 and shall not withhold any such information on the ground that one of the requirements specified in paragraph (2) above is satisfied with respect to the information unless the data user has first consulted the person who appears to the data user to be the appropriate health professional on the question whether either or both of those requirements is or are so satisfied.

(6) In paragraph (5) above “the appropriate health professional” means—

(a) the medical practitioner or dental practitioner who is currently or was most recently responsible for the clinical care of the data subject in connection with the matters to which the information which is the subject of the request relates; or

(b) where there is more than one such practitioner, the practitioner who is the most suitable to advise on the matters to which the information which is the subject of the request relates; or

(c) where there is no practitioner available falling within sub-paragraph (a) or (b) above, a health professional who has the necessary experience and qualifications to advise on the matters to which the information which is the subject of the request relates.

(7) Section 21(8) of the Act shall have effect, in relation to data to which this Order applies, as if the reference therein to a contravention of the foregoing provisions of that section included a reference to a contravention of the provisions contained in this Article.