Regulation 3
1. In this Schedule—
“exempt purposes” in paragraphs 2 to 4 shall mean the purposes specified in sub-paragraph (a) of those paragraphs and in paragraph 5 shall mean the purposes specified in sub-paragraph (b) of that paragraph;
“staff” includes employees or office holders, workers within the meaning given in section 296 of the Trade Union and Labour Relations (Consolidation) Act 1992(1), persons working under any contract for services, and volunteers.
2. The processing—
(a)is for the purposes of appointments or removals, pay, discipline, superannuation, work management or other personnel matters in relation to the staff of the data controller;
(b)is of personal data in respect of which the data subject is—
(i)a past, existing or prospective member of staff of the data controller; or
(ii)any person the processing of whose personal data is necessary for the exempt purposes;
(c)is of personal data consisting of the name, address and other identifiers of the data subject or information as to—
(i)qualifications, work experience or pay; or
(ii)other matters the processing of which is necessary for the exempt purposes;
(d)does not involve disclosure of the personal data to any third party other than—
(i)with the consent of the data subject; or
(ii)where it is necessary to make such disclosure for the exempt purposes; and
(e)does not involve keeping the personal data after the relationship between the data controller and staff member ends, unless and for so long as it is necessary to do so for the exempt purposes.
3. The processing—
(a)is for the purposes of advertising or marketing the data controller’s business, activity, goods or services and promoting public relations in connection with that business or activity, or those goods or services;
(b)is of personal data in respect of which the data subject is—
(i)a past, existing or prospective customer or supplier; or
(ii)any person the processing of whose personal data is necessary for the exempt purposes;
(c)is of personal data consisting of the name, address and other identifiers of the data subject or information as to other matters the processing of which is necessary for the exempt purposes;
(d)does not involve disclosure of the personal data to any third party other than—
(i)with the consent of the data subject; or
(ii)where it is necessary to make such disclosure for the exempt purposes; and
(e)does not involve keeping the personal data after the relationship between the data controller and customer or supplier ends, unless and for so long as it is necessary to do so for the exempt purposes.
4.—(1) The processing—
(a)is for the purposes of keeping accounts relating to any business or other activity carried on by the data controller, or deciding whether to accept any person as a customer or supplier, or keeping records of purchases, sales or other transactions for the purpose of ensuring that the requisite payments and deliveries are made or services provided by or to the data controller in respect of those transactions, or for the purpose of making financial or management forecasts to assist him in the conduct of any such business or activity;
(b)is of personal data in respect of which the data subject is—
(i)a past, existing or prospective customer or supplier; or
(ii)any person the processing of whose personal data is necessary for the exempt purposes;
(c)is of personal data consisting of the name, address and other identifiers of the data subject or information as to—
(i)financial standing; or
(ii)other matters the processing of which is necessary for the exempt purposes;
(d)does not involve disclosure of the personal data to any third party other than—
(i)with the consent of the data subject; or
(ii)where it is necessary to make such disclosure for the exempt purposes; and
(e)does not involve keeping the personal data after the relationship between the data controller and customer or supplier ends, unless and for so long as it is necessary to do so for the exempt purposes.
(2) Sub-paragraph (1)(c) shall not be taken as including personal data processed by or obtained from a credit reference agency.
5. The processing—
(a)is carried out by a data controller which is a body or association which is not established or conducted for profit;
(b)is for the purposes of establishing or maintaining membership of or support for the body or association, or providing or administering activities for individuals who are either members of the body or association or have regular contact with it;
(c)is of personal data in respect of which the data subject is—
(i)a past, existing or prospective member of the body or organisation;
(ii)any person who has regular contact with the body or organisation in connection with the exempt purposes; or
(iii)any person the processing of whose personal data is necessary for the exempt purposes;
(d)is of personal data consisting of the name, address and other identifiers of the data subject or information as to—
(i)eligibility for membership of the body or association; or
(ii)other matters the processing of which is necessary for the exempt purposes;
(e)does not involve disclosure of the personal data to any third party other than—
(i)with the consent of the data subject; or
(ii)where it is necessary to make such disclosure for the exempt purposes; and
(f)does not involve keeping the personal data after the relationship between the data controller and data subject ends, unless and for so long as it is necessary to do so for the exempt purposes.