Schedule 1: Special categories of personal data and criminal convictions etc data Part 3 – Additional conditions relating to criminal convictions etc
This part relates the processing of personal data relating to criminal convictions and offences or related security measures under Article 10 of the GDPR.
	Paragraph 29 permits processing of personal data relating to criminal convictions etc. if the data subject has given his or her consent.
	Paragraph 30 permits processing of personal data relating to criminal convictions etc. where necessary to protect an individual’s vital interests and if the data subject is physically or legally incapable of giving consent.
	Paragraph 31 permits processing of personal data relating to criminal convictions etc. for legitimate activities by not-for-profit bodies with a political, philosophical, religious or trade union aim. The processing must relate to members or former members of that body or to persons who have regular contact with it. Personal data must not be disclosed outside that body without consent from the data subject.
	Paragraph 32 permits processing of personal data relating to criminal convictions etc. of personal data that has been put in the public domain by the data subject.
	Paragraph 33 permits processing of personal data relating to criminal convictions etc. necessary for the purpose of legal proceedings; obtaining legal advice; or establishing, exercising or defending legal rights.
	Paragraph 34 permits processing of personal data relating to criminal convictions etc. necessary when a court or tribunal is acting in its judicial capacity.
	Paragraph 35 permits processing of personal data about a conviction or caution necessary for the administration of an account used in the commission of indecency offences involving children, where the controller has an appropriate policy document in place.
	Section 10(4) and (5) have the effect that processing of criminal convictions etc. data is also permitted under certain conditions in Parts 1 and 2 of the Schedule where the special categories of data permitted to be processed are not limited. Since there is no requirement for processing under Article 10 of the GDPR to be in the substantial public interest, paragraph 36(1) disapplies this express requirement where it exists in Part 2 for the purposes of processing criminal convictions etc. data.
	Paragraph 37 extends paragraph 20 of Schedule 1 so that the processing of criminal conviction etc. data is permitted for an insurance purpose. Because paragraph 20 only permits the processing of specified special categories of data, this provision is needed to ensure that criminal conviction etc. data can be processed.