Source: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/
Timestamp: 2020-01-20 10:21:00
Document Index: 339678838

Matched Legal Cases: ['art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 3', 'art 3', 'art 3', 'art 3', 'art 3', 'art 3', 'art 4', 'art 4', 'art 4', 'art 4', 'art 4', 'art 5', 'art 5', 'art 4', 'art 4', 'art 4', 'art 4', 'art 4', 'art 3']

But the exemption only applies if the health data is:
supplied in a report or evidence given to the court in the course of proceedings; and
those proceedings are subject to certain specific statutory rules that allow the data to be withheld from the individual it relates to.
If you think this exemption might apply to your processing of personal data, see paragraph 3(2) of Schedule 3, Part 2 of the DPA 2018 for full details of the statutory rules.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 3, Part 2, Paragraph 3
Relevant provisions in the GDPR (the exempt provisions) - Articles 5, 13(1)-(3), 14(1)-(4), 15(1)-(3), 16, 17(1)-(2), 18(1), 20(1)-(2), and 21(1)
This exemption can apply if you receive a request (in exercise of a power conferred by an enactment or rule of law) for health data from:
someone with parental responsibility for an individual aged under 18 (or 16 in Scotland); or
someone appointed by the court to manage the affairs of an individual who is incapable of managing their own affairs.
But the exemption only applies to the extent that complying with the request would disclose information that:
the individual provided in the expectation that it would not be disclosed to the requestor, unless the individual has since expressly indicated that they no longer have that expectation;
was obtained as part of an examination or investigation to which the individual consented in the expectation that the information would not be disclosed in this way, unless the individual has since expressly indicated that they no longer have that expectation; or
the individual has expressly indicated should not be disclosed in this way.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 3, Part 2, Paragraph 4
This exemption can apply if you receive a subject access request for health data.
It exempts you from the GDPR’s provisions on the right of access regarding your processing of health data.
But the exemption only applies to the extent that compliance with the right of access would be likely to cause serious harm to the physical or mental health of any individual. This is known as the ‘serious harm test’ for health data.
You can only rely on this exemption if:
you are a health professional; or
within the last six months you have obtained an opinion from an appropriate health professional that the serious harm test for health data is met. Even if you have done this, you still cannot rely on the exemption if it would be reasonable in all the circumstances to re-consult the appropriate health professional.
If you think this exemption might apply to a subject access request you have received, see paragraph 2(1) of Schedule 3, Part 2 of the DPA 2018 for full details of who is considered an appropriate health professional.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 3, Part 2, Paragraph 5
Relevant provisions in the GDPR (the exempt provisions) - Article 15(1)-(3)
This is a restriction rather than an exemption. It applies if you receive a subject access request for health data.
It restricts you from disclosing health data in response to a subject access request, unless:
within the last six months you have obtained an opinion from an appropriate health professional that the serious harm test for health data is not met. Even if you have done this, you must re-consult the appropriate health professional if it would be reasonable in all the circumstances.
This restriction does not apply if you are satisfied that the health data has already been seen by, or is known by, the individual it is about.
If you think this restriction could apply to a subject access request you have received, see paragraph 2(1) of Schedule 3, Part 2 of the DPA 2018 for full details of who is considered an appropriate health professional.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 3, Part 2, Paragraph 6
Relevant provisions in the GDPR (the restricted provisions) - Article 15(1)-(3)
This exemption can apply to social work data (personal data that isn’t health or education data) processed by a court. If you are unsure whether the data you process is social work data, see paragraphs 7(1) and 8 of Schedule 3, Part 3 of the DPA 2018 for full details of what this is.
But the exemption only applies if the social work data is:
those proceedings are subject to certain specific statutory rules that allow the social work data to be withheld from the individual it relates to.
If you think this exemption might apply to your processing of personal data, see paragraph 9(2) of Schedule 3, Part 3 of the DPA 2018 for full details of the statutory rules.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 3, Part 3, Paragraph 9
This exemption can apply if you receive a request (in exercise of a power conferred by an enactment or rule of law) for social work data concerning an individual from:
someone appointed by court to manage the affairs of an individual who is incapable of managing their own affairs.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 3, Part 3, Paragraph 10
This exemption can apply if you receive a subject access request for social work data.
It exempts you from the GDPR’s provisions on the right of access regarding your processing of social work data.
But the exemption only applies to the extent that complying with the right of access would be likely to prejudice carrying out social work because it would be likely to cause serious harm to the physical or mental health of any individual. This is known as the ‘serious harm test’ for social work data.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 3, Part 3, Paragraph 11
This is a restriction rather than an exemption. It applies if you process social work data as a local authority in Scotland (as defined by the Social Work (Scotland) Act 1968), and you receive a subject access request for that data.
It restricts you from disclosing social work data in response to a subject access request if:
the data came from the Principal Reporter (as defined by the Children’s Hearings (Scotland) Act 2011) in the course of his statutory duties; and
the individual whom the data is about is not entitled to receive it from the Principal Reporter.
If there is a question as to whether you need to comply with a subject access request in this situation, you must inform the Principal Reporter within 14 days of the question arising.
You must not disclose the social work data in response to the subject access request unless the Principal Reporter has told you they think the serious harm test for social work data is not met.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 3, Part 3, Paragraph 12
This exemption can apply to education data (personal data in an educational record) processed by a court. If you are unsure whether the data you process is ‘education data’, see paragraphs 13-17 of Schedule 3, Part 4 of the DPA 2018 for full details of what this is.
But the exemption only applies if the education data is:
those proceedings are subject to certain specific statutory rules that allow the education data to be withheld from the individual it relates to.
If you think this exemption might apply to your processing of personal data, see paragraph 18(2) of Schedule 3, Part 4 of the DPA 2018 for full details of the statutory rules.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 3, Part 4, Paragraph 18
This exemption can apply if you receive a subject access request for education data.
It exempts you from the GDPR’s provisions on the right of access regarding your processing of education data.
But the exemption only applies to the extent that complying with the right of access would be likely to cause serious harm to the physical or mental health of any individual. This is known as the ‘serious harm test’ for education data.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 3, Part 4, Paragraph 19
This is a restriction rather than an exemption. It applies if you process education data as an education authority in Scotland (as defined by the Education (Scotland) Act 1980), and you receive a subject access request for that data.
It restricts you from disclosing education data in response to a subject access request if:
you believe that the data came from the Principal Reporter (as defined by the Children’s Hearings (Scotland) Act 2011) in the course of his statutory duties; and
You must not disclose the education data in response to the subject access request unless the Principal Reporter has told you they think the serious harm test for education data is not met.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 3, Part 4, Paragraph 20
This exemption can apply if you receive a request (in exercise of a power conferred by an enactment or rule of law) for child abuse data. If you are unsure whether the data you process is ‘child abuse data’, see paragraph 21(3) of Schedule 3, Part 5 of the DPA 2018 for a definition.
The exemption applies if the request is from:
someone with parental responsibility for an individual aged under 18; or
It exempts you from the GDPR’s provisions on the right of access.
But the exemption only applies to the extent that complying with the request would not be in the best interests of the individual who the child abuse data is about.
This exemption can only apply in England, Wales and Northern Ireland. It cannot apply in Scotland.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 3, Part 5
This exemption can apply if you process personal data in connection with a corporate finance service (e.g. if you underwrite financial instruments or give corporate finance advice to undertakings) that you are permitted to provide (as set out in the Financial Services and Markets Act 2000).
But the exemption only applies to the extent that complying with the provisions above would:
be likely to affect the price of an instrument; or
have a prejudicial effect on the orderly functioning of financial markets (or the efficient allocation of capital within the economy), and you reasonably believe that complying with the provisions above could affect someone’s decision whether to:
deal in, subscribe for or issue a financial instrument, or
act in a way likely to have an effect on a business activity (e.g. an effect on an undertaking’s capital structure, the legal or beneficial ownership of a business or asset or a person’s industrial strategy
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 4, Paragraph 21
This exemption can apply if you process personal data for the purposes of management forecasting or management planning in relation to a business or other activity.
But the exemption only applies to the extent that compliance with the above provisions would be likely to prejudice the conduct of the business or activity.
The senior management of an organisation is planning a re-organisation. This is likely to involve making certain employees redundant, and this possibility is included in management plans. Before the plans are revealed to the workforce, an employee makes a subject access request. In responding to that request, the organisation does not have to reveal its plans to make him redundant if doing so would be likely to prejudice the conduct of the business (perhaps by causing staff unrest before the management’s plans are announced).
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 4, Paragraph 22
This exemption can apply to personal data in records of your intentions relating to any negotiations with an individual.
But it only applies to the extent that complying with the above provisions would be likely to prejudice negotiations with that individual.
An individual makes a claim to his insurance company. The claim is for compensation for personal injuries he sustained in an accident. The insurance company disputes the seriousness of the injuries and the amount of compensation it should pay. An internal paper sets out the company’s position on these matters including the maximum sum it would be willing to pay to avoid the claim going to court. If the individual makes a subject access request to the insurance company, it would not have to send him the internal paper – because doing so would be likely to prejudice the negotiations to settle the claim.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 4, Paragraph 23
This exemption applies if you give or receive a confidential reference for the purposes of prospective or actual:
education, training or employment of an individual;
placement of an individual as a volunteer;
appointment of an individual to office; or
provision by an individual of any service.
Company A provides an employment reference in confidence for one of its employees to company B. If the employee makes a subject access request to company A or company B, the reference will be exempt from disclosure. This is because the exemption applies to the reference regardless of whether it is in the hands of the company that gives it or receives it.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 4, Paragraph 24
This exemption can apply to personal data in exam scripts.
But it only applies to the information recorded by candidates. This means candidates do not have the right to copies of their answers to the exam questions.
However, the information recorded by the person marking the exam is not exempt from the above provisions. If an individual makes a subject access request for this information before the results are announced, special rules apply to how long you have to comply with the request. You must provide the information:
within 40 days of announcing the exam results, if this is earlier.
Relevant provisions in the Data Protection Act 2018 (the exemption) - Schedule 2, Part 4, Paragraph 25
Relevant provisions in the GDPR (the exempt provisions) – Articles 5, 13(1)-(3), 14(1)-(4), and 15(1)-(3)
Paragraphs 16 and 17 of Schedule 2, Part 3 of the DPA 2018 provide an exemption that can apply if you receive a subject access request for information containing the personal data of more than one individual.
See our Guide page on the right of access for guidance on what to do if you receive a request for information that includes the personal data of other people.