The Data Protection (Subject Access Modification) (Health) Order 2000

Exemptions from section 7

5.—(1) Personal data to which this Order applies are exempt from section 7 in any case to the extent to which the application of that section would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person.

(2) Subject to article 7(1), a data controller who is not a health professional shall not withhold information constituting data to which this Order applies on the ground that the exemption in paragraph (1) applies with respect to the information unless the data controller has first consulted the person who appears to the data controller to be the appropriate health professional on the question whether or not the exemption in paragraph (1) applies with respect to the information.

(3) Where any person falling within paragraph (4) is enabled by or under any enactment or rule of law to make a request on behalf of a data subject and has made such a request, personal data to which this Order applies are exempt from section 7 in any case to the extent to which the application of that section would disclose information—

(a) provided by the data subject in the expectation that it would not be disclosed to the person making the request;

(b) obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed; or

(c) which the data subject has expressly indicated should not be so disclosed,

provided that sub-paragraphs (a) and (b) shall not prevent disclosure where the data subject has expressly indicated that he no longer has the expectation referred to therein.

(4) A person falls within this paragraph if—

(a) except in relation to Scotland, the data subject is a child, and that person has parental responsibility for that data subject;

(b) in relation to Scotland, the data subject is a person under the age of sixteen, and that person has parental responsibilities for that data subject; or

(c) the data subject is incapable of managing his own affairs and that person has been appointed by a court to manage those affairs.