SCHEDULES
SCHEDULE 3Exemptions etc from the F1UK GDPR: health, social work, education and child abuse data
PART 2Health data
Exemption from the listed GDPR provisions: data subject's expectations and wishes
4
1
This paragraph applies where a request for data concerning health is made in exercise of a power conferred by an enactment or rule of law and—
a
in relation to England and Wales or Northern Ireland, the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject,
b
in relation to Scotland, the data subject is an individual aged under 16 and the person making the request has parental responsibilities for the data subject, or
c
the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.
2
The listed GDPR provisions do not apply to data concerning health to the extent that complying with the request would disclose information—
a
which was provided by the data subject in the expectation that it would not be disclosed to the person making the request,
b
which was obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed, or
c
which the data subject has expressly indicated should not be so disclosed.
3
The exemptions under sub-paragraph (2)(a) and (b) do not apply if the data subject has expressly indicated that he or she no longer has the expectation mentioned there.
Words in Sch. 3 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)