SCHEDULE 3Exemptions etc from the GDPR: health, social work, education and child abuse data
PART 2Health data
Exemption from Article 15 of the GDPR: serious harm
5
(1)
Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to data concerning health to the extent that the serious harm test is met with respect to the data.
(2)
A controller who is not a health professional may not rely on sub-paragraph (1) to withhold data concerning health unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is met with respect to the data.
(3)
An opinion does not count for the purposes of sub-paragraph (2) if—
(a)
it was obtained before the beginning of the relevant period, or
(b)
it was obtained during that period but it is reasonable in all the circumstances to re-consult the appropriate health professional.
(4)
In this paragraph, “the relevant period” means the period of 6 months ending with the day on which the opinion would be relied on.