SCHEDULES
SCHEDULE 2Exemptions etc from the F1UK GDPR
PART 3Restriction F2for the protection of rights of others
Words in Sch. 2 Pt. 3 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(13) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Protection of the rights of others: general
16
1
Article 15(1) to (3) of the F3UK GDPR (confirmation of processing, access to data and safeguards for third country transfers), and Article 5 of the F3UK GDPR so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3), do not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information.
2
Sub-paragraph (1) does not remove the controller's obligation where—
a
the other individual has consented to the disclosure of the information to the data subject, or
b
it is reasonable to disclose the information to the data subject without the consent of the other individual.
3
In determining whether it is reasonable to disclose the information without consent, the controller must have regard to all the relevant circumstances, including—
a
the type of information that would be disclosed,
b
any duty of confidentiality owed to the other individual,
c
any steps taken by the controller with a view to seeking the consent of the other individual,
d
whether the other individual is capable of giving consent, and
e
any express refusal of consent by the other individual.
4
For the purposes of this paragraph—
a
“information relating to another individual” includes information identifying the other individual as the source of information;
b
an individual can be identified from information to be provided to a data subject by a controller if the individual can be identified from—
i
that information, or
ii
that information and any other information that the controller reasonably believes the data subject is likely to possess or obtain.
Words in Sch. 2 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)