General processing Individuals’ rights
There are some limited circumstances where it is appropriate to create exemptions to the usual rights that individuals have over their personal data. The Act ensures that exemptions in the 1998 Act continue to apply, as well as introducing a number of new restrictions.
	The 1998 Act contained exemptions to disapply individual rights in relation to personal data held by regulatory bodies performing functions concerned with protecting the public from incompetence, malpractice, dishonesty or seriously improper conduct, or concerning health and safety; charities; or ensuring fair competition in business. For example, without appropriate exemptions a corrupt official might be able to find out how his or her corruption is being exposed. Similarly exemptions exist to ensure that the judiciary have a ‘safe space’ in which to conduct their work, where they are free to make such records in the course of reaching their judgment, without fear that such records (such as annotations, recorded discussions) may be investigated or challenged by parties to proceedings. The Act ensures that exemptions of this sort continue to be available.
	In some cases, there are also public policy reasons to limit individual rights where there are on-going investigations into their conduct. While investigations by law enforcement agencies are not covered by GDPR and provided for separately in the Act, there are instances where other investigations may benefit from exemptions from the requirement to apply individual rights. For example, section 29(1) of the 1998 Act enabled Her Majesty’s Revenue and Customs ("HMRC") to withhold certain personal data on a case by case basis from an individual customer who submitted a subject access request if providing that personal data would be likely to prejudice specified crime and taxation purposes. It also meant that HMRC was not obliged to send a privacy notice to an individual when obtaining personal data from a third party if it would tip them off about an ongoing investigation into their tax affairs. The Act makes equivalent provision.
	In the context of health, social work and education, there is sometimes information that is recorded about a person that is given on the condition that it is not disclosed to the person. If such information was disclosable the information would not be given. This could, for example, result in safeguarding concerns or limit a Court’s ability to properly assess the best interests of the child in proceedings concerned with the care of children. Disclosure of personal data could also result in serious harm to the data subject or another individual. The 1998 Act and various orders made under powers in the Act provided exemptions to in respect of health, social work and education data. For example, the Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413) applied to personal data consisting of information as to the physical or mental health or condition of the data subject. The Act ensures that exemptions of this sort continue to apply.
	The 1998 Act provided that personal data processed only for research, historical or statistical purposes could be exempted from subject access requests, subject to its being processed in compliance with certain conditions. The new Act exercises all of the derogations in Article 89(2) and (3) of the GDPR, and retains the relevant conditions, to ensure that research organisations and archiving services do not have to respond to subject access requests when this would seriously impair or prevent them from fulfilling their purposes. Further, the Act contains provision to exercise derogations so that research organisations do not have to comply with an individual’s rights to rectify, restrict further processing and object to processing where this would seriously impede their ability to complete their work, and providing that appropriate organisational safeguards are in place to keep the data secure.
	As it is difficult to predict what matters may in future be considered important objectives of general public interest deserving protection, it is also difficult to predict what rights and obligations may need to be restricted in order to safeguard those objectives. The Act therefore provides the Secretary of State with the power to make further exemptions in future.