Data Protection Act 1998

Part II U.K. Exemptions available before 24th October 2001

Manual data U.K.

2 (1) Eligible manual data, other than data forming part of an accessible record, are exempt from the data protection principles and Parts II and III of this Act during the first transitional period. U.K.

(2) This paragraph does not apply to eligible manual data to which paragraph 4 applies.

3 (1) This paragraph applies to— U.K.

(a) eligible manual data forming part of an accessible record, and

(b) personal data which fall within paragraph (d) of the definition of “data” in section 1(1) but which, because they are not subject to processing which was already under way immediately before 24th October 1998, are not eligible data for the purposes of this Schedule.

(2) During the first transitional period, data to which this paragraph applies are exempt from—

(a) the data protection principles, except the sixth principle so far as relating to sections 7 and 12A,

(b) Part II of this Act, except—

(i) section 7 (as it has effect subject to section 8) and section 12A, and

(ii) section 15 so far as relating to those sections, and

(c) Part III of this Act.

4 (1) This paragraph applies to eligible manual data which consist of information relevant to the financial standing of the data subject and in respect of which the data controller is a credit reference agency. U.K.

(2) During the first transitional period, data to which this paragraph applies are exempt from—

(a) the data protection principles, except the sixth principle so far as relating to sections 7 and 12A,

(b) Part II of this Act, except—

(i) section 7 (as it has effect subject to sections 8 and 9) and section 12A, and

(ii) section 15 so far as relating to those sections, and

(c) Part III of this Act.

Processing otherwise than by reference to the data subject U.K.

5 U.K. During the first transitional period, for the purposes of this Act (apart from paragraph 1), eligible automated data are not to be regarded as being “processed” unless the processing is by reference to the data subject.

Payrolls and accounts U.K.

6 (1) Subject to sub-paragraph (2), eligible automated data processed by a data controller for one or more of the following purposes— U.K.

(a) calculating amounts payable by way of remuneration or pensions in respect of service in any employment or office or making payments of, or of sums deducted from, such remuneration or pensions, or

(b) keeping accounts relating to any business or other activity carried on by the data controller or keeping records of purchases, sales or other transactions for the purpose of ensuring that the requisite payments are made by or to him in respect of those transactions or for the purpose of making financial or management forecasts to assist him in the conduct of any such business or activity,

are exempt from the data protection principles and Parts II and III of this Act during the first transitional period.

(2) It shall be a condition of the exemption of any eligible automated data under this paragraph that the data are not processed for any other purpose, but the exemption is not lost by any processing of the eligible data for any other purpose if the data controller shows that he had taken such care to prevent it as in all the circumstances was reasonably required.

(3) Data processed only for one or more of the purposes mentioned in sub-paragraph (1)(a) may be disclosed—

(a) to any person, other than the data controller, by whom the remuneration or pensions in question are payable,

(b) for the purpose of obtaining actuarial advice,

(c) for the purpose of giving information as to the persons in any employment or office for use in medical research into the health of, or injuries suffered by, persons engaged in particular occupations or working in particular places or areas,

(d) if the data subject (or a person acting on his behalf) has requested or consented to the disclosure of the data either generally or in the circumstances in which the disclosure in question is made, or

(e) if the person making the disclosure has reasonable grounds for believing that the disclosure falls within paragraph (d).

(4) Data processed for any of the purposes mentioned in sub-paragraph (1) may be disclosed—

(a) for the purpose of audit or where the disclosure is for the purpose only of giving information about the data controller’s financial affairs, or

(b) in any case in which disclosure would be permitted by any other provision of this Part of this Act if sub-paragraph (2) were included among the non-disclosure provisions.

(5) In this paragraph “remuneration” includes remuneration in kind and “pensions” includes gratuities or similar benefits.

Unincorporated members’ clubs and mailing lists U.K.

7 U.K. Eligible automated data processed by an unincorporated members’ club and relating only to the members of the club are exempt from the data protection principles and Parts II and III of this Act during the first transitional period.

8 U.K. Eligible automated data processed by a data controller only for the purposes of distributing, or recording the distribution of, articles or information to the data subjects and consisting only of their names, addresses or other particulars necessary for effecting the distribution, are exempt from the data protection principles and Parts II and III of this Act during the first transitional period.

9 U.K. Neither paragraph 7 nor paragraph 8 applies to personal data relating to any data subject unless he has been asked by the club or data controller whether he objects to the data relating to him being processed as mentioned in that paragraph and has not objected.

10 U.K. It shall be a condition of the exemption of any data under paragraph 7 that the data are not disclosed except as permitted by paragraph 11 and of the exemption under paragraph 8 that the data are not processed for any purpose other than that mentioned in that paragraph or as permitted by paragraph 11, but—

(a) the exemption under paragraph 7 shall not be lost by any disclosure in breach of that condition, and

(b) the exemption under paragraph 8 shall not be lost by any processing in breach of that condition,

if the data controller shows that he had taken such care to prevent it as in all the circumstances was reasonably required.

11 U.K. Data to which paragraph 10 applies may be disclosed—

(a) if the data subject (or a person acting on his behalf) has requested or consented to the disclosure of the data either generally or in the circumstances in which the disclosure in question is made,

(b) if the person making the disclosure has reasonable grounds for believing that the disclosure falls within paragraph (a), or

(c) in any case in which disclosure would be permitted by any other provision of this Part of this Act if paragraph 8 were included among the non-disclosure provisions.

Back-up data U.K.

12 U.K. Eligible automated data which are processed only for the purpose of replacing other data in the event of the latter being lost, destroyed or impaired are exempt from section 7 during the first transitional period.

Exemption of all eligible automated data from certain requirements U.K.

13 (1) During the first transitional period, eligible automated data are exempt from the following provisions— U.K.

(a) the first data protection principle to the extent to which it requires compliance with—

(i) paragraph 2 of Part II of Schedule 1,

(ii) the conditions in Schedule 2, and

(iii) the conditions in Schedule 3,

(b) the seventh data protection principle to the extent to which it requires compliance with paragraph 12 of Part II of Schedule 1;

(c) the eighth data protection principle,

(d) in section 7(1), paragraphs (b), (c)(ii) and (d),

(e) sections 10 and 11,

(f) section 12, and

(g) section 13, except so far as relating to—

(i) any contravention of the fourth data protection principle,

(ii) any disclosure without the consent of the data controller,

(iii) loss or destruction of data without the consent of the data controller, or

(iv) processing for the special purposes.

(2) The specific exemptions conferred by sub-paragraph (1)(a), (c) and (e) do not limit the data controller’s general duty under the first data protection principle to ensure that processing is fair.