The Data Protection (Processing of Sensitive Personal Data) Order 2012

Statutory Instruments

2012 No. 1978

Data Protection

The Data Protection (Processing of Sensitive Personal Data) Order 2012

Made

25th July 2012

Coming into force in accordance with article 1

The Secretary of State makes the following Order in exercise of the powers conferred by section 67(2) of, and paragraph 10 of Schedule 3 to, the Data Protection Act 1998(1).

In accordance with section 67(3) of that Act, the Secretary of State has consulted the Information Commissioner.

In accordance with section 67(4) of that Act, a draft of this Order was laid before and approved by a resolution of each House of Parliament.

Citation and commencement

1.  This Order may be cited as the Data Protection (Processing of Sensitive Personal Data) Order 2012 and comes into force on the day after the day on which it is made.

Circumstances specified for the purposes of processing sensitive personal data

2.—(1) The circumstances in paragraph (2) are specified for the purposes of paragraph 10 of Schedule 3 to the Data Protection Act 1998.

(2) The circumstances are the disclosure of sensitive personal data relating to the events that occurred at Hillsborough Stadium in Sheffield on 15th April 1989 where that disclosure is necessary to give effect to the protocol on disclosure of information published on 15th December 2009 by the Secretary of State for the Home Department for the purposes of the Hillsborough Independent Panel established on that date by that Secretary of State(2).

McNally

Minister of State

Ministry of Justice

25th July 2012

EXPLANATORY NOTE

(This note is not part of the Order)

The Data Protection Act 1998 (c. 29) (“the Act”) regulates, amongst other things, the processing of “sensitive personal data”, as defined in section 2. The first data protection principle, set out in paragraph 1 of Schedule 1 to the Act, prohibits the processing of “sensitive personal data” unless one of the conditions in Schedule 3 to the Act is met. The condition in paragraph 10 of that Schedule is that the personal data are processed in circumstances specified in an order made by the Secretary of State. This Order specifies certain circumstances for the purposes of that paragraph.

Those circumstances are the disclosure of sensitive personal data where that is necessary to give effect to the protocol on disclosure of information relating to the Hillsborough Stadium disaster which occurred on 15th April 1989. The protocol envisages disclosure of information which relates to that disaster that is held by public bodies and was prepared by the Secretary of State for the Home Department for the purposes of the Hillsborough Independent Panel, a non-statutory body established by the Secretary of State on 15th December 2009. The protocol was published by the Secretary of State for the Home Department on the same date and is available at http://webarchive.nationalarchives.gov.uk/20100413151441/ http://homeoffice.gov.uk/documents/hillsborough-tor.html.

(1)

1998 c. 29.

(2)

The protocol on disclosure of information was published by the Secretary of State for the Home Department on 15th December 2009 (Official Report, 15th December 2009, HC, col. 111WS and HL, col. WS240).