SCHEDULES

SCHEDULE 2Exemptions etc from the GDPR

PART 3Restriction based on Article 23(1): protection of rights of others

16Protection of the rights of others: general

1

Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers), and Article 5 of the GDPR so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3), do not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information.

2

Sub-paragraph (1) does not remove the controller’s obligation where—

a

the other individual has consented to the disclosure of the information to the data subject, or

b

it is reasonable to disclose the information to the data subject without the consent of the other individual.

3

In determining whether it is reasonable to disclose the information without consent, the controller must have regard to all the relevant circumstances, including—

a

the type of information that would be disclosed,

b

any duty of confidentiality owed to the other individual,

c

any steps taken by the controller with a view to seeking the consent of the other individual,

d

whether the other individual is capable of giving consent, and

e

any express refusal of consent by the other individual.

4

For the purposes of this paragraph—

a

“information relating to another individual” includes information identifying the other individual as the source of information;

b

an individual can be identified from information to be provided to a data subject by a controller if the individual can be identified from—

i

that information, or

ii

that information and any other information that the controller reasonably believes the data subject is likely to possess or obtain.