Further Reading: Additional lawful bases of processing for special category (sensitive) personal data

Further Reading: Additional lawful bases of processing for special category (sensitive) personal data

Processing of personal data of a special category is prohibited unless it is:

  1. With the Explicit consent of the individual;
  2. In the field of employment, social security and social protection law
  3. To protect the vital interests of an individual or third party, physically or legally incapable of giving consent
  4. By foundations, association or other not-for-profit bodies with political, philosophical, religious or trade union aims in certain circumstances
  5. Has been manifestly made public by the individual
  6. For the establishment, exercise or defence of legal claims
  7. For reasons of substantial public interest on a basis in law
  8. In relation to the provision of medical services and of health and social care on a basis in law
  9. For public interest in the field of public health on a basis in law
  10. For archiving, scientific or historical research or statistical purposes on a basis in law.

Section 10 and Parts 1, 2 and 3 of Schedule 1 of the DPA 2018 authorises processing of special categories of personal data.

Part 1 sets out conditions relating to employment, health and research

Part 2 sets out conditions relating to substantial public interest

Part 3 includes derogations relating to criminal convictions

Part 4 sets out additional safeguards which must be in place for other derogations to be lawful

Section 8 of the DPA 2018 assists with what is included in the meaning of ‘public interest’

When creating a Record of Processing Activities (Article 30), identify the appropriate lawful basis for the processing for each data flow. If relying on legitimate interests carry out an assessment and record the findings

References:

Article 9 and Recitals (51) to (56) of the GDPR

Section 10 and Parts 1, 2, 3 and 4 of Schedule 1 of the DPA 2018

ICO guidance providing links to further guidance

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection- regulation-gdpr/special-category-data/what-are-the-conditions-for-processing/