- Latest available (Revised)
- Point in Time (31/01/2022)
- Original (As enacted)
Version Superseded: 01/07/2022
Point in time view as at 31/01/2022.
Data Protection Act 2018, SCHEDULE 3 is up to date with all changes known to be in force on or before 02 September 2024. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
Section 15
Textual Amendments
F1Words in Sch. 3 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Textual Amendments
F2Words in Sch. 3 Pt. 1 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
1U.K.In this Schedule “the listed GDPR provisions” means the following provisions of the [F3UK GDPR] (the rights and obligations in which may be restricted by virtue of Article 23(1) of the [F3UK GDPR])—
(a)Article 13(1) to (3) (personal data collected from data subject: information to be provided);
(b)Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
(c)Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
(d)Article 16 (right to rectification);
(e)Article 17(1) and (2) (right to erasure);
(f)Article 18(1) (restriction of processing);
(g)Article 20(1) and (2) (right to data portability);
(h)Article 21(1) (objections to processing);
(i)Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (h).
Textual Amendments
F3Words in Sch. 3 para. 1 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
2(1)In this Part of this Schedule—U.K.
“the appropriate health professional”, in relation to a question as to whether the serious harm test is met with respect to data concerning health, means—
the health professional who is currently or was most recently responsible for the diagnosis, care or treatment of the data subject in connection with the matters to which the data relates,
where there is more than one such health professional, the health professional who is the most suitable to provide an opinion on the question, or
a health professional who has the necessary experience and qualifications to provide an opinion on the question, where—
there is no health professional available falling within paragraph (a) or (b), or
the controller is the Secretary of State and data is processed in connection with the exercise of the functions conferred on the Secretary of State by or under the Child Support Act 1991 and the Child Support Act 1995, or the Secretary of State's functions in relation to social security or war pensions, or
the controller is the Department for Communities in Northern Ireland and data is processed in connection with the exercise of the functions conferred on the Department by or under the Child Support (Northern Ireland) Order 1991 (S.I. 1991/2628 (N.I. 23)) and the Child Support (Northern Ireland) Order 1995 (S.I. 1995/2702 (N.I. 13));
“war pension” has the same meaning as in section 25 of the Social Security Act 1989 (establishment and functions of war pensions committees).
(2)For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to data concerning health if the application of Article 15 of the [F4UK GDPR] to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
Textual Amendments
F4Words in Sch. 3 para. 2(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
3(1)The listed GDPR provisions do not apply to data concerning health if—U.K.
(a)it is processed by a court,
(b)it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and
(c)in accordance with those rules, the data may be withheld by the court in whole or in part from the data subject.
(2)Those rules are—
(a)the Magistrates' Courts (Children and Young Persons) Rules (Northern Ireland) 1969 (S.R. (N.I.) 1969 No. 221);
(b)the Magistrates' Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));
(c)the Family Proceedings Rules (Northern Ireland) 1996 (S.R. (N.I.) 1996 No. 322);
(d)the Magistrates' Courts (Children (Northern Ireland) Order 1995) Rules (Northern Ireland) 1996 (S.R. (N. I.) 1996 No. 323);
(e)the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));
(f)the Sheriff Court Adoption Rules 2009;
(g)the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));
(h)the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).
4(1)This paragraph applies where a request for data concerning health is made in exercise of a power conferred by an enactment or rule of law and—U.K.
(a)in relation to England and Wales or Northern Ireland, the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject,
(b)in relation to Scotland, the data subject is an individual aged under 16 and the person making the request has parental responsibilities for the data subject, or
(c)the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.
(2)The listed GDPR provisions do not apply to data concerning health to the extent that complying with the request would disclose information—
(a)which was provided by the data subject in the expectation that it would not be disclosed to the person making the request,
(b)which was obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed, or
(c)which the data subject has expressly indicated should not be so disclosed.
(3)The exemptions under sub-paragraph (2)(a) and (b) do not apply if the data subject has expressly indicated that he or she no longer has the expectation mentioned there.
Textual Amendments
F5Words in Sch. 3 para. 5 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
5(1)Article 15(1) to (3) of the [F6UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers) do not apply to data concerning health to the extent that the serious harm test is met with respect to the data.U.K.
(2)A controller who is not a health professional may not rely on sub-paragraph (1) to withhold data concerning health unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is met with respect to the data.
(3)An opinion does not count for the purposes of sub-paragraph (2) if—
(a)it was obtained before the beginning of the relevant period, or
(b)it was obtained during that period but it is reasonable in all the circumstances to re-consult the appropriate health professional.
(4)In this paragraph, “the relevant period” means the period of 6 months ending with the day on which the opinion would be relied on.
Textual Amendments
F6Words in Sch. 3 para. 5(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(7) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Textual Amendments
F7Words in Sch. 3 para. 6 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(8) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
6(1)Article 15(1) to (3) of the [F8UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers) do not permit the disclosure of data concerning health by a controller who is not a health professional unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is not met with respect to the data.U.K.
(2)Sub-paragraph (1) does not apply to the extent that the controller is satisfied that the data concerning health has already been seen by, or is within the knowledge of, the data subject.
(3)An opinion does not count for the purposes of sub-paragraph (1) if—
(a)it was obtained before the beginning of the relevant period, or
(b)it was obtained during that period but it is reasonable in all the circumstances to re-consult the appropriate health professional.
(4)In this paragraph, “the relevant period” means the period of 6 months ending with the day on which the opinion would be relied on.
Textual Amendments
F8Words in Sch. 3 para. 6(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(9) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
7(1)In this Part of this Schedule—U.K.
“education data” has the meaning given by paragraph 17 of this Schedule;
“Health and Social Care trust” means a Health and Social Care trust established under the Health and Personal Social Services (Northern Ireland) Order 1991 (S.I. 1991/194 (N.I. 1));
“Principal Reporter” means the Principal Reporter appointed under the Children's Hearings (Scotland) Act 2011 (asp 1), or an officer of the Scottish Children's Reporter Administration to whom there is delegated under paragraph 10(1) of Schedule 3 to that Act any function of the Principal Reporter;
“social work data” means personal data which—
is data to which paragraph 8 applies, but
is not education data or data concerning health.
(2)For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to social work data if the application of Article 15 of the [F9UK GDPR] to the data would be likely to prejudice carrying out social work, because it would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
(3)In sub-paragraph (2), “carrying out social work” is to be taken to include doing any of the following—
(a)the exercise of any functions mentioned in paragraph 8(1)(a), (d), (f) to (j), (m), (p), (s), (t), (u), (v) or (w);
(b)the provision of any service mentioned in paragraph 8(1)(b), (c) or (k);
(c)the exercise of the functions of a body mentioned in paragraph 8(1)(e) or a person mentioned in paragraph 8(1)(q) or (r).
(4)In this Part of this Schedule, a reference to a local authority, in relation to data processed or formerly processed by it, includes a reference to the Council of the Isles of Scilly, in relation to data processed or formerly processed by the Council in connection with any functions mentioned in paragraph 8(1)(a)(ii) which are or have been conferred on the Council by an enactment.
Textual Amendments
F9Words in Sch. 3 para. 7(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(10) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
8(1)This paragraph applies to personal data falling within any of the following descriptions—U.K.
(a)data processed by a local authority—
(i)in connection with its social services functions (within the meaning of the Local Authority Social Services Act 1970 or the Social Services and Well-being (Wales) Act 2014 (anaw 4)) or any functions exercised by local authorities under the Social Work (Scotland) Act 1968 or referred to in section 5(1B) of that Act, or
(ii)in the exercise of other functions but obtained or consisting of information obtained in connection with any of the functions mentioned in sub-paragraph (i);
(b)data processed by the Regional Health and Social Care Board—
(i)in connection with the provision of social care within the meaning of section 2(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)), or
(ii)in the exercise of other functions but obtained or consisting of information obtained in connection with the provision of that care;
(c)data processed by a Health and Social Care trust—
(i)in connection with the provision of social care within the meaning of section 2(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)) on behalf of the Regional Health and Social Care Board by virtue of an authorisation made under Article 3(1) of the Health and Personal Social Services (Northern Ireland) Order 1994 (S.I. 1994/429 (N.I. 2)), or
(ii)in the exercise of other functions but obtained or consisting of information obtained in connection with the provision of that care;
(d)data processed by a council in the exercise of its functions under Part 2 of Schedule 9 to the Health and Social Services and Social Security Adjudications Act 1983;
(e)data processed by—
(i)a probation trust established under section 5 of the Offender Management Act 2007, or
(ii)the Probation Board for Northern Ireland established by the Probation Board (Northern Ireland) Order 1982 (S.I. 1982/713 (N.I. 10));
(f)data processed by a local authority in the exercise of its functions under section 36 of the Children Act 1989 or Chapter 2 of Part 6 of the Education Act 1996, so far as those functions relate to ensuring that children of compulsory school age (within the meaning of section 8 of the Education Act 1996) receive suitable education whether by attendance at school or otherwise;
(g)data processed by the Education Authority in the exercise of its functions under Article 55 of the Children (Northern Ireland) Order 1995 (S.I. 1995/755 (N.I. 2)) or Article 45 of, and Schedule 13 to, the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)), so far as those functions relate to ensuring that children of compulsory school age (within the meaning of Article 46 of the Education and Libraries (Northern Ireland) Order 1986) receive efficient full-time education suitable to their age, ability and aptitude and to any special educational needs they may have, either by regular attendance at school or otherwise;
(h)data processed by an education authority in the exercise of its functions under sections 35 to 42 of the Education (Scotland) Act 1980 so far as those functions relate to ensuring that children of school age (within the meaning of section 31 of the Education (Scotland) Act 1980) receive efficient education suitable to their age, ability and aptitude, whether by attendance at school or otherwise;
(i)data relating to persons detained in a hospital at which high security psychiatric services are provided under section 4 of the National Health Service Act 2006 and processed by a Special Health Authority established under section 28 of that Act in the exercise of any functions similar to any social services functions of a local authority;
(j)data relating to persons detained in special accommodation provided under Article 110 of the Mental Health (Northern Ireland) Order 1986 (S.I. 1986/595 (N.I. 4)) and processed by a Health and Social Care trust in the exercise of any functions similar to any social services functions of a local authority;
(k)data which—
(i)is processed by the National Society for the Prevention of Cruelty to Children, or by any other voluntary organisation or other body designated under this paragraph by the Secretary of State or the Department of Health in Northern Ireland, and
(ii)appears to the Secretary of State or the Department, as the case may be, to be processed for the purposes of the provision of any service similar to a service provided in the exercise of any functions specified in paragraph (a), (b), (c) or (d);
(l)data processed by a body mentioned in sub-paragraph (2)—
(i)which was obtained, or consists of information which was obtained, from an authority or body mentioned in any of paragraphs (a) to (k) or from a government department, and
(ii)in the case of data obtained, or consisting of information obtained, from an authority or body mentioned in any of paragraphs (a) to (k), fell within any of those paragraphs while processed by the authority or body;
(m)data processed by a National Health Service trust first established under section 25 of the National Health Service Act 2006, section 18 of the National Health Service (Wales) Act 2006 or section 5 of the National Health Service and Community Care Act 1990 in the exercise of any functions similar to any social services functions of a local authority;
(n)data processed by an NHS foundation trust in the exercise of any functions similar to any social services functions of a local authority;
(o)data processed by a government department—
(i)which was obtained, or consists of information which was obtained, from an authority or body mentioned in any of paragraphs (a) to (n), and
(ii)which fell within any of those paragraphs while processed by that authority or body;
(p)data processed for the purposes of the functions of the Secretary of State pursuant to section 82(5) of the Children Act 1989;
(q)data processed by—
(i)a children's guardian appointed under Part 16 of the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17)),
(ii)a guardian ad litem appointed under Article 60 of the Children (Northern Ireland) Order 1995 (S.I. 1995/755 (N.I. 2)) or Article 66 of the Adoption (Northern Ireland) Order 1987 (S.I. 1987/2203 (N.I. 22)), or
(iii)a safeguarder appointed under section 30(2) or 31(3) of the Children's Hearings (Scotland) Act 2011 (asp 1);
(r)data processed by the Principal Reporter;
(s)data processed by an officer of the Children and Family Court Advisory and Support Service for the purpose of the officer's functions under section 7 of the Children Act 1989 or Part 16 of the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));
(t)data processed by the Welsh family proceedings officer for the purposes of the functions under section 7 of the Children Act 1989 or Part 16 of the Family Procedure Rules 2010;
(u)data processed by an officer of the service appointed as guardian ad litem under Part 16 of the Family Procedure Rules 2010;
(v)data processed by the Children and Family Court Advisory and Support Service for the purpose of its functions under section 12(1) and (2) and section 13(1), (2) and (4) of the Criminal Justice and Court Services Act 2000;
(w)data processed by the Welsh Ministers for the purposes of their functions under section 35(1) and (2) and section 36(1), (2), (4), (5) and (6) of the Children Act 2004;
(x)data processed for the purposes of the functions of the appropriate Minister pursuant to section 12 of the Adoption and Children Act 2002 (independent review of determinations).
(2)The bodies referred to in sub-paragraph (1)(l) are—
(a)a National Health Service trust first established under section 25 of the National Health Service Act 2006 or section 18 of the National Health Service (Wales) Act 2006;
(b)a National Health Service trust first established under section 5 of the National Health Service and Community Care Act 1990;
(c)an NHS foundation trust;
(d)a clinical commissioning group established under section 14D of the National Health Service Act 2006;
(e)the National Health Service Commissioning Board;
(f)a Local Health Board established under section 11 of the National Health Service (Wales) Act 2006;
(g)a Health Board established under section 2 of the National Health Service (Scotland) Act 1978.
9(1)The listed GDPR provisions do not apply to data that is not education data or data concerning health if—U.K.
(a)it is processed by a court,
(b)it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and
(c)in accordance with any of those rules, the data may be withheld by the court in whole or in part from the data subject.
(2)Those rules are—
(a)the Magistrates' Courts (Children and Young Persons) Rules (Northern Ireland) 1969 (S.R. (N.I.) 1969 No. 221);
(b)the Magistrates' Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));
(c)the Family Proceedings Rules (Northern Ireland) 1996 (S.R. (N.I.) 1996 No. 322);
(d)the Magistrates' Courts (Children (Northern Ireland) Order 1995) Rules (Northern Ireland) 1996 (S.R. (N. I.) 1996 No. 323);
(e)the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));
(f)the Sheriff Court Adoption Rules 2009;
(g)the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));
(h)the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).
10(1)This paragraph applies where a request for social work data is made in exercise of a power conferred by an enactment or rule of law and—U.K.
(a)in relation to England and Wales or Northern Ireland, the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject,
(b)in relation to Scotland, the data subject is an individual aged under 16 and the person making the request has parental responsibilities for the data subject, or
(c)the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.
(2)The listed GDPR provisions do not apply to social work data to the extent that complying with the request would disclose information—
(a)which was provided by the data subject in the expectation that it would not be disclosed to the person making the request,
(b)which was obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed, or
(c)which the data subject has expressly indicated should not be so disclosed.
(3)The exemptions under sub-paragraph (2)(a) and (b) do not apply if the data subject has expressly indicated that he or she no longer has the expectation mentioned there.
Textual Amendments
F10Words in Sch. 3 para. 11 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(11) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
11U.K.Article 15(1) to (3) of the [F11UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers) do not apply to social work data to the extent that the serious harm test is met with respect to the data.
Textual Amendments
F11Words in Sch. 3 para. 11 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(12) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Textual Amendments
F12Words in Sch. 3 para. 12 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(13) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
12(1)This paragraph applies where—U.K.
(a)a question arises as to whether a controller who is a social work authority is obliged by Article 15(1) to (3) of the [F13UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers) to disclose social work data, and
(b)the data—
(i)originated from or was supplied by the Principal Reporter acting in pursuance of the Principal Reporter's statutory duties, and
(ii)is not data which the data subject is entitled to receive from the Principal Reporter.
(2)The controller must inform the Principal Reporter of the fact that the question has arisen before the end of the period of 14 days beginning when the question arises.
(3)Article 15(1) to (3) of the [F14UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers) do not permit the controller to disclose the data to the data subject unless the Principal Reporter has informed the controller that, in the opinion of the Principal Reporter, the serious harm test is not met with respect to the data.
(4)In this paragraph “social work authority” means a local authority for the purposes of the Social Work (Scotland) Act 1968.
Textual Amendments
F13Words in Sch. 3 para. 12(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(14) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F14Words in Sch. 3 para. 12(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(14) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
13U.K.In this Part of this Schedule “educational record” means a record to which paragraph 14, 15 or 16 applies.
14(1)This paragraph applies to a record of information which—U.K.
(a)is processed by or on behalf of the proprietor of, or a teacher at, a school in England and Wales specified in sub-paragraph (3),
(b)relates to an individual who is or has been a pupil at the school, and
(c)originated from, or was supplied by or on behalf of, any of the persons specified in sub-paragraph (4).
(2)But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.
(3)The schools referred to in sub-paragraph (1)(a) are—
(a)a school maintained by a local authority;
(b)an Academy school;
(c)an alternative provision Academy;
(d)an independent school that is not an Academy school or an alternative provision Academy;
(e)a non-maintained special school.
(4)The persons referred to in sub-paragraph (1)(c) are—
(a)an employee of the local authority which maintains the school;
(b)in the case of—
(i)a voluntary aided, foundation or foundation special school (within the meaning of the School Standards and Framework Act 1998),
(ii)an Academy school,
(iii)an alternative provision Academy,
(iv)an independent school that is not an Academy school or an alternative provision Academy, or
(v)a non-maintained special school,
a teacher or other employee at the school (including an educational psychologist engaged by the proprietor under a contract for services);
(c)the pupil to whom the record relates;
(d)a parent, as defined by section 576(1) of the Education Act 1996, of that pupil.
(5)In this paragraph—
“independent school” has the meaning given by section 463 of the Education Act 1996;
“local authority” has the same meaning as in that Act (see sections 579(1) and 581 of that Act);
“non-maintained special school” has the meaning given by section 337A of that Act;
“proprietor” has the meaning given by section 579(1) of that Act.
15(1)This paragraph applies to a record of information which is processed—U.K.
(a)by an education authority in Scotland, and
(b)for the purpose of the relevant function of the authority.
(2)But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.
(3)For the purposes of this paragraph, information processed by an education authority is processed for the purpose of the relevant function of the authority if the processing relates to the discharge of that function in respect of a person—
(a)who is or has been a pupil in a school provided by the authority, or
(b)who receives, or has received, further education provided by the authority.
(4)In this paragraph “the relevant function” means, in relation to each education authority, its function under section 1 of the Education (Scotland) Act 1980 and section 7(1) of the Self-Governing Schools etc. (Scotland) Act 1989.
16(1)This paragraph applies to a record of information which—U.K.
(a)is processed by or on behalf of the Board of Governors, proprietor or trustees of, or a teacher at, a school in Northern Ireland specified in sub-paragraph (3),
(b)relates to an individual who is or has been a pupil at the school, and
(c)originated from, or was supplied by or on behalf of, any of the persons specified in sub-paragraph (4).
(2)But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.
(3)The schools referred to in sub-paragraph (1)(a) are—
(a)a grant-aided school;
(b)an independent school.
(4)The persons referred to in sub-paragraph (1)(c) are—
(a)a teacher at the school;
(b)an employee of the Education Authority, other than a teacher at the school;
(c)an employee of the Council for Catholic Maintained Schools, other than a teacher at the school;
(d)the pupil to whom the record relates;
(e)a parent, as defined by Article 2(2) of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)).
(5)In this paragraph, “grant-aided school”, “independent school”, “proprietor” and “trustees” have the same meaning as in the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)).
17(1)In this Part of this Schedule—U.K.
“education authority” and “further education” have the same meaning as in the Education (Scotland) Act 1980;
“education data” means personal data consisting of information which—
constitutes an educational record, but
is not data concerning health;
“Principal Reporter” means the Principal Reporter appointed under the Children's Hearings (Scotland) Act 2011 (asp 1), or an officer of the Scottish Children's Reporter Administration to whom there is delegated under paragraph 10(1) of Schedule 3 to that Act any function of the Principal Reporter;
“pupil” means—
in relation to a school in England and Wales, a registered pupil within the meaning of the Education Act 1996,
in relation to a school in Scotland, a pupil within the meaning of the Education (Scotland) Act 1980, and
in relation to a school in Northern Ireland, a registered pupil within the meaning of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3));
“school”—
in relation to England and Wales, has the same meaning as in the Education Act 1996,
in relation to Scotland, has the same meaning as in the Education (Scotland) Act 1980, and
in relation to Northern Ireland, has the same meaning as in the Education and Libraries (Northern Ireland) Order 1986;
“teacher” includes—
in Great Britain, head teacher, and
in Northern Ireland, the principal of a school.
(2)For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to education data if the application of Article 15 of the [F15UK GDPR] to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
Textual Amendments
F15Words in Sch. 3 para. 17(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(15) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
18(1)The listed GDPR provisions do not apply to education data if—U.K.
(a)it is processed by a court,
(b)it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and
(c)in accordance with those rules, the data may be withheld by the court in whole or in part from the data subject.
(2)Those rules are—
(a)the Magistrates' Courts (Children and Young Persons) Rules (Northern Ireland) 1969 (S.R. (N.I.) 1969 No. 221);
(b)the Magistrates' Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));
(c)the Family Proceedings Rules (Northern Ireland) 1996 (S.R. (N.I.) 1996 No. 322);
(d)the Magistrates' Courts (Children (Northern Ireland) Order 1995) Rules (Northern Ireland) 1996 (S.R. (N. I.) 1996 No. 323);
(e)the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));
(f)the Sheriff Court Adoption Rules 2009;
(g)the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));
(h)the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).
Textual Amendments
F16Words in Sch. 3 para. 19 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(16) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
19U.K.Article 15(1) to (3) of the [F17UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers) do not apply to education data to the extent that the serious harm test is met with respect to the data.
Textual Amendments
F17Words in Sch. 3 para. 19 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(17) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Textual Amendments
F18Words in Sch. 3 para. 20 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(18) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
20(1)This paragraph applies where—U.K.
(a)a question arises as to whether a controller who is an education authority is obliged by Article 15(1) to (3) of the [F19UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers) to disclose education data, and
(b)the controller believes that the data—
(i)originated from or was supplied by or on behalf of the Principal Reporter acting in pursuance of the Principal Reporter's statutory duties, and
(ii)is not data which the data subject is entitled to receive from the Principal Reporter.
(2)The controller must inform the Principal Reporter of the fact that the question has arisen before the end of the period of 14 days beginning when the question arises.
(3)Article 15(1) to (3) of the [F20UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers) do not permit the controller to disclose the data to the data subject unless the Principal Reporter has informed the controller that, in the opinion of the Principal Reporter, the serious harm test is not met with respect to the data.
Textual Amendments
F19Words in Sch. 3 para. 20(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(19) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F20Words in Sch. 3 para. 20(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(19) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Textual Amendments
F21Words in Sch. 3 para. 21 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(20) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
21(1)This paragraph applies where a request for child abuse data is made in exercise of a power conferred by an enactment or rule of law and—U.K.
(a)the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject, or
(b)the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.
(2)Article 15(1) to (3) of the [F22UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers) do not apply to child abuse data to the extent that the application of that provision would not be in the best interests of the data subject.
(3)“Child abuse data” is personal data consisting of information as to whether the data subject is or has been the subject of, or may be at risk of, child abuse.
(4)For this purpose, “child abuse” includes physical injury (other than accidental injury) to, and physical and emotional neglect, ill-treatment and sexual abuse of, an individual aged under 18.
(5)This paragraph does not apply in relation to Scotland.
Textual Amendments
F22Words in Sch. 3 para. 21(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(21) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.
Original (As Enacted or Made): The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.
Point in Time: This becomes available after navigating to view revised legislation as it stood at a certain point in time via Advanced Features > Show Timeline of Changes or via a point in time advanced search.
Geographical Extent: Indicates the geographical area that this provision applies to. For further information see ‘Frequently Asked Questions’.
Show Timeline of Changes: See how this legislation has or could change over time. Turning this feature on will show extra navigation options to go to these specific points in time. Return to the latest available version by using the controls above in the What Version box.
Text created by the government department responsible for the subject matter of the Act to explain what the Act sets out to achieve and to make the Act accessible to readers who are not legally qualified. Explanatory Notes were introduced in 1999 and accompany all Public Acts except Appropriation, Consolidated Fund, Finance and Consolidation Acts.
Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:
This timeline shows the different points in time where a change occurred. The dates will coincide with the earliest date on which the change (e.g an insertion, a repeal or a substitution) that was applied came into force. The first date in the timeline will usually be the earliest date when the provision came into force. In some cases the first date is 01/02/1991 (or for Northern Ireland legislation 01/01/2006). This date is our basedate. No versions before this date are available. For further information see the Editorial Practice Guide and Glossary under Help.
Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:
Click 'View More' or select 'More Resources' tab for additional information including: