The Data Protection (Processing of Sensitive Personal Data) Order 2000

Explanatory Note

(This note is not part of the Order)

The first data protection principle set out in paragraph 1 of Schedule 1 to the Data Protection Act 1998 prohibits the processing of sensitive personal data unless one of the conditions in Schedule 3 to the Act is met. The condition set out in paragraph 10 of that Schedule is that the processing of sensitive personal data is carried out in circumstances specified by the Secretary of State. The Schedule to this Order specifies ten such circumstances.

Paragraph 1 of the Schedule to this Order covers certain processing for the purposes of the prevention or detection of any unlawful act, where seeking the consent of the data subject to the processing would prejudice those purposes. Paragraph 2 is a similar provision for cases where the processing is required to discharge functions which protect members of the public from certain conduct which may not constitute an unlawful act, such as incompetence or mismanagement.

Paragraph 3 of the Schedule covers certain disclosures for journalistic, artistic or literary purposes of personal data relating to a wide range of conduct (e.g. unlawful acts, dishonesty and incompetence etc.).

Paragraph 4 of the Schedule covers processing required to discharge functions involving the provision of services such as confidential counselling and advice, in circumstances where the consent of the data subject is not obtained for one of the specified reasons set out in the paragraph.

Paragraph 5 of the Schedule covers processing in certain insurance or occupational pension scheme contexts, where details of particular relatives of the principal insured or member are required (e.g. health details of relatives used to calculate the life expectancy of the insured). The data controller must not process these data to make decisions or take actions with respect to the relatives, nor if he is aware of the relative withholding his consent to the processing.

Paragraph 6 of the Schedule covers the processing of sensitive data that were already being processed before the coming into force of this Order in certain insurance and pension contexts. Like the provision in paragraph 5, the data controller must not continue to process these data if he is aware of the data subject withholding his consent to the processing. Alternatively, the data controller may continue the processing in the case of group insurance or pension schemes even without the explicit consent of the data subject to avoid prejudice to that insurance policy or pension scheme.

Paragraph 9 of Schedule 3 to the Data Protection Act 1998 provides as a condition relevant for the purposes of the first data protection principle that the processing is of personal data relating to racial or ethnic origin for the purposes of ethnic monitoring. Paragraph 7 of the Schedule to this Order makes similar provision in relation to the monitoring of equality between persons with different religious beliefs or between persons of differing physical or mental states or conditions.

Paragraph 8 of the Schedule relates to the processing of information about political opinions by registered political parties, provided such processing does not cause substantial damage or distress to any person.

Paragraph 9 of the Schedule covers, for example, processing in the course of maintaining archives where the sensitive personal data are not used to take decisions about any person without their consent and no substantial damage or distress is caused to any person by the keeping of those data.

Paragraph 10 of the Schedule covers processing by the police in the exercise of their common law powers.

This Order contributes to the implementation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

A Regulatory Impact Assessment was prepared for the Data Protection Bill as it was then and the statutory instruments to be made under it, and was placed in the libraries of both Houses of Parliament. The Regulatory Impact Assessment is now available on the internet at www.homeoffice.gov.uk. Alternatively, copies can be obtained by post from the Home Office, LGDP Unit, 50 Queen Anne’s Gate, London SW1H 9AT.