Data Protection Act 1998

Section 4(3).

SCHEDULE 3 U.K. Conditions relevant for purposes of the first principle: processing of sensitive personal data

1 U.K. The data subject has given his explicit consent to the processing of the personal data.

2 (1) The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment. U.K.

(2) The [F1 Secretary of State] may by order—

(a) exclude the application of sub-paragraph (1) in such cases as may be specified, or

(b) provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.

Textual Amendments

F1 Words in Sch. 3 para. 2 substituted (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), art. 9, Sch. 2 para. 9(1)(b)

Commencement Information

I1 Sch. 3 para. 2 wholly in force at 1.3.2000; Sch. 3 para. 2 in force for certain purposes at Royal Assent see s. 75(2)(i); Sch. 3 para. 2 in force at 1.3.2000 insofar as not already in force by S.I. 2000/183, art. 2(1)

3 U.K. The processing is necessary—

(a) in order to protect the vital interests of the data subject or another person, in a case where—

(i) consent cannot be given by or on behalf of the data subject, or

(ii) the data controller cannot reasonably be expected to obtain the consent of the data subject, or

(b) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld.

4 U.K. The processing—

(a) is carried out in the course of its legitimate activities by any body or association which—

(i) is not established or conducted for profit, and

(ii) exists for political, philosophical, religious or trade-union purposes,

(b) is carried out with appropriate safeguards for the rights and freedoms of data subjects,

(c) relates only to individuals who either are members of the body or association or have regular contact with it in connection with its purposes, and

(d) does not involve disclosure of the personal data to a third party without the consent of the data subject.

5 U.K. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

6 U.K. The processing—

(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

(c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

7 (1) The processing is necessary— U.K.

(a) for the administration of justice,

[F2 (aa) for the exercise of any functions of either House of Parliament,]

(b) for the exercise of any functions conferred on any person by or under an enactment, or

(c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department.

(2) The [F3 Secretary of State] may by order—

(a) exclude the application of sub-paragraph (1) in such cases as may be specified, or

(b) provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.

Textual Amendments

F2 Sch. 3 para. 7(1)(aa) inserted (1.1.2005) by 2000 c. 36, ss. 73, 87(3), Sch. 6 para. 4 (with ss. 56, 78); S.I. 2004/1909, art. 2; S.I. 2004/3122, art. 2

F3 Words in Sch. 3 para. 7 substituted (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), art. 9, Sch. 2 para. 9(1)(b)

Modifications etc. (not altering text)

C1 Sch. 3 para. 7 extended (2.12.1999) by S.I. 1999/3145, arts. 1, 9(3)(b); S.I. 1999/3208, art. 2

Commencement Information

I2 Sch. 3 para. 7 wholly in force at 1.3.2000; Sch. 3 para. 7 in force for certain purposes at Royal Assent see s. 75(2)(i); Sch. 3 para. 7 in force at 1.3.2000 insofar as not already in force by S.I. 2000/183, art. 2(1)

[F4 7A (1) The processing— U.K.

(a) is either—

(i) the disclosure of sensitive personal data by a person as a member of an anti-fraud organisation or otherwise in accordance with any arrangements made by such an organisation; or

(ii) any other processing by that person or another person of sensitive personal data so disclosed; and

(b) is necessary for the purposes of preventing fraud or a particular kind of fraud.

(2) In this paragraph “an anti-fraud organisation” means any unincorporated association, body corporate or other person which enables or facilitates any sharing of information to prevent fraud or a particular kind of fraud or which has any of these functions as its purpose or one of its purposes.]

Textual Amendments

F4 Sch. 3 para. 7A inserted (1.10.2008) by Serious Crime Act 2007 (c. 27), ss. 72, 94; S.I. 2008/2504, art. 2(e)

[F5 7B U.K. The processing is necessary for the purposes of making a disclosure in good faith under a power conferred by—

(a) section 21CA of the Terrorism Act 2000 (disclosures between certain entities within regulated sector in relation to suspicion of commission of terrorist financing offence or for purposes of identifying terrorist property), or

(b) section 339ZB of the Proceeds of Crime Act 2002 (disclosures within regulated sector in relation to money laundering suspicion).]

Textual Amendments

F5 Sch. 3 para. 7B inserted (27.4.2017 for specified purposes) by Criminal Finances Act 2017 (c. 22), s. 58(5)(6), Sch. 5 para. 8

8 (1) The processing is necessary for medical purposes and is undertaken by— U.K.

(a) a health professional, or

(b) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.

(2) In this paragraph “medical purposes” includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.

9 (1) The processing— U.K.

(a) is of sensitive personal data consisting of information as to racial or ethnic origin,

(b) is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons of different racial or ethnic origins, with a view to enabling such equality to be promoted or maintained, and

(c) is carried out with appropriate safeguards for the rights and freedoms of data subjects.

(2) The [F6 Secretary of State] may by order specify circumstances in which processing falling within sub-paragraph (1)(a) and (b) is, or is not, to be taken for the purposes of sub-paragraph (1)(c) to be carried out with appropriate safeguards for the rights and freedoms of data subjects.

Textual Amendments

F6 Words in Sch. 3 para. 9 substituted (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), art. 9, Sch. 2 para. 9(1)(b)

Commencement Information

I3 Sch. 3 para. 9 wholly in force at 1.3.2000; Sch. 3 para. 9 in force for certain purposes at Royal Assent see s. 75(2)(i); Sch. 3 para. 9 in force at 1.3.2000 insofar as not already in force by S.I. 2000/183, art. 2(1)

10 U.K. The personal data are processed in circumstances specified in an order made by the [F7 Secretary of State] for the purposes of this paragraph.

Textual Amendments

F7 Words in Sch. 3 para. 10 substituted (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), art. 9, Sch. 2 para. 9(1)(b)

Commencement Information

I4 Sch. 3 para. 10 wholly in force at 1.3.2000; Sch. 3 para. 10 in force for certain purposes at Royal Assent see s. 75(2)(i); Sch. 3 para. 10 in force at 1.3.2000 insofar as not already in force by S.I. 2000/183, art. 2(1)