Source: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/?q=article+4
Timestamp: 2019-09-23 13:50:10
Document Index: 611116438

Matched Legal Cases: ['art 3', 'art 3', 'art 1', 'art 1', 'art 1', 'art 4', 'art 4', 'art 1', 'art 1', 'art 1', 'art 1', 'art 6', 'art 2', 'art 10', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 5', 'art 6', 'art 6']

You should justify and document your reasons for relying on an exemption.
If no exemption covers what you do with personal data, you need to comply with the GDPR as normal.
☐ We consider whether we can rely on an exemption on a case-by-case basis.
☐ Where appropriate, we carefully consider the extent to which the relevant GDPR requirements would be likely to prevent, seriously impair, or prejudice the achievement of our processing purposes.
☐ We justify and document our reasons for relying on an exemption.
☐ When an exemption does not apply (or no longer applies) to our processing of personal data, we comply with the GDPR’s requirements as normal.
What’s new under the GDPR and the Data Protection Act 2018?
Not much has changed. Most of the exemptions in the Data Protection Act 1998 (the 1998 Act) are included as exceptions built in to certain GDPR provisions or exemptions in the Data Protection Act 2018 (the DPA 2018).
The ‘domestic purposes’ exemption in the 1998 Act is not replicated. This is because the GDPR does not apply to personal data processed in the course of a purely personal or household activity, with no connection to a professional or commercial activity.
If you used to rely on certain exemptions under the 1998 Act, the things you are exempt from may have changed slightly under the GDPR and the DPA 2018. You should check what is covered by the exemptions in the DPA 2018 and ensure that your use of any of the exemptions is appropriate and compliant.
In some circumstances, the DPA 2018 provides an exemption from particular GDPR provisions. If an exemption applies, you may not have to comply with all the usual rights and obligations.
This part of the Guide focuses on the exemptions in Schedules 2-4 of the DPA 2018. We give guidance on the exceptions built in to the GDPR in the parts of the Guide that relate to the relevant provisions.
dealing with other individual rights;
reporting personal data breaches; and
complying with the principles.
Law enforcement – the processing of personal data by competent authorities for law enforcement purposes is outside the GDPR’s scope (e.g. the Police investigating a crime). Instead, this type of processing is subject to the rules in Part 3 of the DPA 2018. See our Guide to Law Enforcement Processing for further information.
be likely to prejudice your purpose (e.g. have a damaging or detrimental effect on what you are doing); or
Crime and taxation: risk assessment
Disclosure prohibited or restricted by an enactment
Bank of England functions
Regulation, parliament and the judiciary
Judicial appointments, independence and proceedings
Journalism, academia, art and literature
Health data – processed by a court
Health data – an individual’s expectations and wishes
Health data – serious harm
Health data – restriction of the right of access
Social work data – processed by a court
Social work data – an individual’s expectations and wishes
Social work data – serious harm
Social work data – restriction of the right of access
Education data – processed by a court
Education data – serious harm
Education data – restriction of the right of access
Subject access requests – information about other people
There are two parts to this exemption. The first part can apply if you process personal data for the purposes of:
It exempts you from the GDPR’s provisions on:
all the other individual rights, except rights related to automated individual decision-making including profiling;
notifying individuals of personal data breaches;
the lawfulness, fairness and transparency principle, except the requirement for processing to be lawful;
the purpose limitation principle; and
all the other principles, but only so far as they relate to the right to be informed and the other individual rights.
But the exemption only applies to the extent that complying with these provisions would be likely to prejudice your purposes of processing. If this is not so, you must comply with the GDPR as normal.
A bank conducts an investigation into suspected financial fraud. The bank wants to pass its investigation file, including the personal data of several customers, to the National Crime Agency (NCA) for further investigation. The bank’s investigation and proposed disclosure to the NCA are for the purposes of the prevention and detection of crime. The bank decides that, were it to inform the individuals in question about this processing of their personal data, this would be likely to prejudice the investigation because they might abscond or destroy evidence. So the bank relies on the crime and taxation exemption and, in this case, does not comply with the right to be informed.
The second part of this exemption applies when another controller obtains personal data processed for any of the purposes mentioned above for the purposes of discharging statutory functions. The controller that obtains the personal data is exempt from the GDPR provisions below to the same extent that the original controller was exempt:
All the principles, but only so far as they relate to the right to be informed and the right of access.
Note that if you are a competent authority processing personal data for law enforcement purposes (e.g. the Police conducting a criminal investigation), your processing is subject to the rules of Part 3 of the DPA 2018. See our Guide to Law Enforcement Processing for information on how individual rights may be restricted when personal data is processed for law enforcement purposes by competent authorities.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 1, Paragraph 2
Relevant provisions in the GDPR (the exempt provisions) - Articles 5, 13(1)-(3), 14(1)-(4), 15(1)-(3), 16, 17(1) and (2), 18(1), 19, 20(1) and (2), 21(1), and 34(1) and (4)
This exemption can apply to personal data in a classification applied to an individual as part of a risk assessment system.
The risk assessment system must be operated by a government department, local authority, or another authority administering housing benefit, for the purposes of:
the assessment or collection of a tax or duty; or
the prevention or detection of crime or the apprehension or prosecution of offenders, where the offence involves the unlawful use of public money or an unlawful claim for payment out of public money.
But the exemption only applies to the extent that complying with these provisions would prevent the risk assessment system from operating effectively. If this is not so, you must comply with these provisions as normal.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 1, Paragraph 3
Relevant provisions in the GDPR (the exempt provisions) - Articles 5, 13(1)-(3), 14(1)-(4), and 15(1)-(3)
This exemption has three parts. The first part can apply if you are required by law to make personal data available to the public.
But the exemption only applies to the extent that complying with these provisions would prevent you meeting your legal obligation to make personal data publicly available.
The Registrar of Companies is legally obliged to maintain a public register of certain information about companies, including the names and (subject to certain restrictions) addresses of company directors. A director asks to exercise his right to erasure by having his name and address removed from the register. The request does not need to be complied with as it would prevent the Registrar meeting his legal obligation to make that information publicly available.
The second part of this exemption can apply if you are required by law, or court order, to disclose personal data to a third party. It exempts you from the same provisions as above, but only to the extent that complying with those provisions would prevent you disclosing the personal data.
An employer receives a court order to hand over the personnel file of one of its employees to an insurance company for the assessment of a claim. Normally, the employer would not be able to disclose this information because doing so would be incompatible with the original purposes for collecting the data (contravening the purpose limitation principle). However, on this occasion the employer is exempt from the purpose limitation principle’s requirements because it would prevent the employer disclosing personal data that it must do by court order.
The third part of this exemption can apply if it is necessary for you to disclose personal data for the purposes of, or in connection with:
legal proceedings, including prospective legal proceedings;
It exempts you from the same provisions as above, but only to the extent that complying with them would prevent you disclosing the personal data. If complying with these provisions would not prevent the disclosure, you cannot rely on the exemption.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 1, Paragraph 5
Relevant provisions in the GDPR (the exempt provisions) - Articles 5, 13(1)-(3), 14(1)-(4), 15(1)-(3), 16, 17(1)-(2), 18(1), 19, 20(1)-(2), and 21(1)
This exemption applies if you process personal data:
to which a claim to legal professional privilege (or confidentiality of communications in Scotland) could be maintained in legal proceedings; or
in respect of which a duty of confidentiality is owed by a professional legal adviser to his client.
the right of access; and
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 4, Paragraph 19
This exemption can apply if complying with the GDPR provisions below would reveal evidence that you have committed an offence.
But the exemption only applies to the extent that complying with these provisions would expose you to proceedings for the offence.
This exemption does not apply to an offence under the DPA 2018 or an offence regarding false statements made otherwise than on oath.
But any information you do provide to an individual in response to a subject access request is not admissible against you in proceedings for an offence under the DPA 2018.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 4, Paragraph 20
Five separate exemptions apply to personal data that is prohibited or restricted from disclosure by an enactment.
Each of them exempts you from the GDPR’s provisions on:
all the principles, but only so far as they relate to the right of access.
But the exemptions only apply to personal data restricted or prohibited from disclosure by certain specific provisions of enactments covering:
parental orders; and
children’s hearings.
If you think any of these exemptions might apply to your processing of personal data, see Schedule 4 of the DPA 2018 for full details of the enactments that are covered.
Relevant provisions in the Data Protection Act 2018 (the exemptions) - Schedule 4
Relevant provisions in the GDPR (the exempt provisions) - Articles 5 and 15(1)-(3)
There are two parts to this exemption. The first part can apply if you process personal data for the purposes of maintaining effective immigration control, including investigatory/detection work (the immigration purposes).
all the principles, but only so far as they relate to the rights to be informed, of access, to erasure, to restrict processing and to object.
But the exemption only applies to the extent that applying these provisions would be likely to prejudice processing for the immigration purposes. If not, the exemption does not apply.
The second part of this exemption applies when personal data processed by any controller is obtained and processed by another controller for the immigration purposes. The controller that discloses the personal data is exempt from the GDPR’s provisions on:
The exemption only applies to the same extent that the second controller is exempt from these provisions.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 1, Paragraph 4
Relevant provisions in the GDPR (the exempt provisions) – Articles 5, 13(1)-(3), 14(1)-(4), 15(1)-(3), 16, 17(1)-(2), 18(1) and 21(1)
This exemption can apply if you process personal data for the purposes of discharging one of six functions designed to protect the public.
The first four functions must: be conferred on a person by enactment; be a function of the Crown, a Minister of the Crown or a government department; or be of a public nature and exercised in the public interest. These functions are:
to protect the public against financial loss due to the seriously improper conduct (or unfitness, or incompetence) of financial services providers, or in the management of bodies corporate, or due to the conduct of bankrupts;
to protect the public against seriously improper conduct (or unfitness, or incompetence);
to protect charities or community interest companies against misconduct or mismanagement in their administration, to protect the property of charities or community interest companies from loss or misapplication, or to recover the property of charities or community interest companies; or
to secure workers’ health, safety and welfare or to protect others against health and safety risks in connection with (or arising from) someone at work.
The fifth function must be conferred by enactment on: the Parliamentary Commissioner for Administration; the Commissioner for Local Administration in England; the Health Service Commissioner for England; the Public Services Ombudsman for Wales; the Northern Ireland Public Services Ombudsman; the Prison Ombudsman for Northern Ireland; or the Scottish Public Services Ombudsman. This function is:
to protect the public from maladministration, or a failure in services provided by a public body, or from the failure to provide a service that it is a function of a public body to provide.
The sixth function must be conferred by enactment on the Competition and Markets Authority. This function is:
to protect members of the public from business conduct adversely affecting them, to regulate conduct (or agreements) preventing, restricting or distorting commercial competition, or to regulate undertakings abusing a dominant market position.
If you process personal data for any of the above functions, you are exempt from the GDPR’s provisions on:
all the other individual rights, except rights related to automated individual decision-making including profiling; and
all the principles, but only so far as they relate to the right to be informed and the other individual rights.
But the exemption only applies to the extent that complying with these provisions would be likely to prejudice the proper discharge of your functions. If you can comply with these provisions and discharge your functions as normal, you must do so.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 1, Paragraph 7
This exemption can apply if you process personal data for the purposes of discharging a function conferred by enactment on:
the Auditor General for Scotland;
the Auditor General for Wales; or
But the exemption only applies to the extent that complying with these provisions would be likely to prejudice the proper discharge of your functions. If it does not, you must comply with the GDPR as normal.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 1, Paragraph 8
This exemption can apply if you process personal data for the purposes of discharging a function of the Bank of England:
in its capacity as a monetary authority;
that is a public function (within the meaning of Section 349 of the Financial Services and Markets Act 2000); or
that is conferred on the Prudential Regulation Authority by enactment.
But the exemption only applies to the extent that complying with these provisions would be likely to prejudice the proper discharge of your functions. If this is not so, the exemption does not apply.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 1, Paragraph 9
This exemption can apply if you process personal data for the purposes of discharging a function of:
considering a complaint under:
Part 6 of the Legal Services Act 2007,
Section 14 of the NHS Redress Act 2006,
Section 113(1) or (2), or Section 114(1) or (3) of the Health and Social Care (Community Health and Standards) Act 2003,
Section 24D or 26 of the Children’s Act 1989, or
Part 2A of the Public Services Ombudsman (Wales) Act 2005; or
considering a complaint or representations under Chapter 1, Part 10 of the Social Services and Well-being (Wales) Act 2014.
But the exemption only applies to the extent that complying with these provisions would be likely to prejudice the proper discharge of your functions. If you can comply with these provisions and discharge your functions as normal, you cannot rely on the exemption.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 2, Paragraph 10
This exemption can apply if you process personal data for the purpose of discharging a regulatory function conferred under specific, listed legislation on any one of 14 bodies and persons. These are:
the Pensions Ombudsman;
the Board of the Pension Protection Fund;
the Ombudsman for the Board of the Pension Protection Fund;
the Financial Ombudsman;
the investigator of complaints against the financial regulators;
a consumer protection enforcer (other than the Competition and Markets Authority);
the monitoring officer of a relevant authority;
the monitoring officer of a relevant Welsh authority;
the Public Services Ombudsman for Wales; or
But the exemption only applies to the extent that complying with these provisions would be likely to prejudice the proper discharge of your function. If this is not so, you must comply with these provisions as you normally would.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 2, Paragraphs 11-12
Relevant provisions in the GDPR (the exempt provisions) – Articles 5, 13(1)-(3), 14(1)-(4), 15(1)-(3), 16, 17(1)-(2), 18(1), 19, 20(1)-(2), 21(1) and 34(1) and (4)
This exemption can apply if it is required to avoid the privileges of either House of Parliament being infringed.
the communication of personal data breaches to individuals; and
But if you can comply with these provisions without infringing parliamentary privilege, you must do so.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 2, Paragraph 13
Relevant provisions in the GDPR (the exempt provisions) - Articles 5, 13(1)-(3), 14(1)-(4), 15(1)-(3), 16, 17(1)-(2), 18(1), 19, 20(1)-(2), 21(1), and 34(1) and (4)
for the purposes of assessing a person’s suitability for judicial office or the office of Queen’s Counsel;
as an individual acting in a judicial capacity; or
as a court or tribunal acting in its judicial capacity.
Additionally, even if you do not process personal data for the reasons above, you are also exempt from the same provisions of the GDPR to the extent that complying with them would be likely to prejudice judicial independence or judicial proceedings.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 2, Paragraph 14
This exemption applies if you process personal data for the purposes of:
conferring any honour or dignity by the Crown; or
assessing a person’s suitability for any of the following offices:
archbishops and diocesan and suffragan bishops in the Church of England,
deans of cathedrals of the Church of England,
deans and canons of the two Royal Peculiars,
the First and Second Church Estates Commissioners,
lord-lieutenants,
Masters of Trinity College and Churchill College, Cambridge,
the Provost of Eton,
the Poet Laureate, or
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 2, Paragraph 15
artistic purposes; or
Together, these are known as the ‘special purposes’.
The exemption relieves you from your obligations regarding the GDPR’s provisions on:
all the principles, except the security and accountability principles;
the lawful bases;
the conditions for consent;
children’s consent;
the conditions for processing special categories of personal data and data about criminal convictions and offences;
processing not requiring identification;
the communication of personal data breaches to individuals;
consultation with the ICO for high risk processing;
cooperation and consistency between supervisory authorities.
But the exemption only applies to the extent that:
as controller for the processing of personal data, you reasonably believe that compliance with these provisions would be incompatible with the special purposes (this must be more than just an inconvenience);
the processing is being carried out with a view to the publication of some journalistic, academic, artistic or literary material; and
you reasonably believe that the publication of the material would be in the public interest, taking into account the special importance of the general public interest in freedom of expression, any specific public interest in the particular subject, and the potential to harm individuals.
When deciding whether it is reasonable to believe that publication would be in the public interest, you must (if relevant) have regard to:
the BBC Editorial Guidelines;
the Ofcom Broadcasting Code; and
the Editors’ Code of Practice.
We expect you to be able to explain why the exemption is required in each case, and how and by whom this was considered at the time. The ICO does not have to agree with your view – but we must be satisfied that you had a reasonable belief.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 5, Paragraph 26
Relevant provisions in the GDPR (the exempt provisions) - Articles 5(1)(a)-(e), 6, 7, 8(1)-(2), 9, 10, 11(2), 13(1)-(3), 14(1)-(4), 15(1)-(3), 16, 17(1)-(2), 18(1)(a)-(b) and (d), 19, 20(1)-(2), 21(1), 34(1) and (4), 36, 44, and 60-67
The GDPR also provides exceptions from its provisions on the right to be informed (for indirectly collected data) and the right to erasure.
But the exemption and the exceptions only apply:
if the processing is subject to appropriate safeguards for individuals’ rights and freedoms (see Article 89(1) of the GDPR – among other things, you must implement data minimisation measures);
Additionally, the GDPR contains specific provisions that adapt the application of the purpose limitation and storage limitation principles when you process personal data for scientific or historical research purposes, or statistical purposes. See the Guide pages on these principles for more detail.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 6, Paragraph 27
Relevant provisions in the GDPR (the exempt provisions) - Articles 5(1)(b) and (e), 14(1)-(4), 15(1)-(3), 16, 18(1) and 21(1)
This exemption can apply if you process personal data for archiving purposes in the public interest.
the obligation to notify others regarding rectification, erasure or restriction;
if the processing is not likely to cause substantial damage or substantial distress to an individual; and
Additionally, the GDPR contains specific provisions that adapt the application of the purpose limitation and storage limitation principles when you process personal data for archiving purposes in the public interest. See the Guide pages on these principles for more detail.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 6, Paragraph 28
Relevant provisions in the GDPR (the exempt provisions) - Articles 5(1)(b) and (e), 14(1)-(4), 15(1)-(3), 16, 18(1), 19, 20(1) and 21(1)
Relevant provisions in the GDPR (the appropriate safeguards) - Article 89(1) and Recital 156
Relevant provisions in the Data Protection Act 2018 (safeguards) - Section 19
Further reading – The National Archives
The National Archives is the official archive and publisher for the UK Government and for England and Wales. It has published a detailed guide to archiving personal data