SCHEDULE
Article 2
CIRCUMSTANCES IN WHICH SENSITIVE PERSONAL DATA MAY BE PROCESSED
1.—(1) The processing—
(a)
(a) is in the substantial public interest;
(b)
(b) is necessary for the purposes of the prevention or detection of any unlawful act; and
(c)
(c) must necessarily be carried out without the explicit consent of the data subject being sought so as not to prejudice those purposes.
(2) In this paragraph, “act” includes a failure to act.
2. The processing—
(a) is in the substantial public interest;
(b) is necessary for the discharge of any function which is designed for protecting members of the public against–
(i) dishonesty, malpractice, or other seriously improper conduct by, or the unfitness or incompetence of, any person, or
(ii) mismanagement in the administration of, or failures in services provided by, any body or association; and
(c) must necessarily be carried out without the explicit consent of the data subject being sought so as not to prejudice the discharge of that function.
3.—(1) The disclosure of personal data—
(a)
(a) is in the substantial public interest;
(b)
(b) is in connection with—
(i) the commission by any person of any unlawful act (whether alleged or established),
(ii) dishonesty, malpractice, or other seriously improper conduct by, or the unfitness or incompetence of, any person (whether alleged or established), or
(iii) mismanagement in the administration of, or failures in services provided by, any body or association (whether alleged or established);
(c)
(c) is for the special purposes as defined in section 3 of the Act; and
(d)
(d) is made with a view to the publication of those data by any person and the data controller reasonably believes that such publication would be in the public interest.
(2) In this paragraph, “act” includes a failure to act.
4. The processing—
(a) is in the substantial public interest;
(b) is necessary for the discharge of any function which is designed for the provision of confidential counselling, advice, support or any other service; and
(c) is carried out without the explicit consent of the data subject because the processing—
(i) is necessary in a case where consent cannot be given by the data subject,
(ii) is necessary in a case where the data controller cannot reasonably be expected to obtain the explicit consent of the data subject, or
(iii) must necessarily be carried out without the explicit consent of the data subject being sought so as not to prejudice the provision of that counselling, advice, support or other service.
5.—(1) The processing—
(a)
(a) is necessary for the purpose of—
(i) carrying on insurance business, or
(ii) making determinations in connection with eligibility for, and benefits payable under, an occupational pension scheme as defined in section 1 of the Pension Schemes Act 19932;
(b)
(b) is of sensitive personal data consisting of information falling within section 2(e) of the Act relating to a data subject who is the parent, grandparent, great grandparent or sibling of—
(i) in the case of paragraph (a)(i), the insured person, or
(ii) in the case of paragraph (a)(ii), the member of the scheme;
(c)
(c) is necessary in a case where the data controller cannot reasonably be expected to obtain the explicit consent of that data subject and the data controller is not aware of the data subject withholding his consent; and
(d)
(d) does not support measures or decisions with respect to that data subject.
(2) In this paragraph—
(a)
(a) “insurance business” means insurance business, as defined in section 95 of the Insurance Companies Act 19823, falling within Classes I, III or IV of Schedule 1 (classes of long term business) or Classes 1 or 2 of Schedule 2 (classes of general business) to that Act, and
(b)
(b) “insured” and “member” includes an individual who is seeking to become an insured person or member of the scheme respectively.
6. The processing—
(a) is of sensitive personal data in...
