Schedule 3: Exemptions etc from the GDPR: health, social work, education and child abuse data
This Schedule makes provision for restrictions from certain GDPR provisions where this is necessary for health, education and social work purposes. It seeks to preserve the substance of the orders made under section 30 of the 1998 Act:
	The Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413);
	The Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414); and
	The Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415).
	Part 1 sets out the listed GDPR provisions restricted by the exemptions in this Schedule.
	Part 2 restricts the application of the listed GDPR provisions in relation to data concerning health. Restrictions apply where:
	the application of the listed GDPR provisions would be likely to cause serious harm to the physical or mental condition of the data subject, or any other person;
	information is processed by a court and consists of information supplied in a report or other evidence given to the court by certain bodies;
	a request is made on behalf of the data subject by the person with parental responsibility for the data subject or by the person appointed by the court to manage his or her affairs would result in disclosure of information contrary to the data subject’s expectations and wishes.
	Part 3 restricts the application of the listed GDPR provisions in relation to social work data. The restrictions apply to personal data processed by a range of authorities or bodies pursuant to specified social services functions and by the courts in children’s and family proceedings. Restrictions apply where:
	the application of the listed GDPR provisions would be like be likely to cause serious harm to the physical or mental health of the data subject or any other person;
	the information has been provided to a court and the court may withhold from the data subject;
	a request is made on behalf of the data subject for information the data subject has expressly indicated should not be disclosed.
	Part 4 restricts the application of the listed GDPR provisions in relation to education data. Restrictions apply where:
	the data has been provided to a court in certain proceedings and it is information that the court may withhold from the data subject;
	exercise of the right would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person.
	Part 5 restricts the application of Articles 13(1) to (3), 14(1) to (4) and 15(1) to (3) to the processing of personal data consisting of information as to whether the data subject is or has been the subject of or may be at risk of child abuse, to the extent it would not be in the best interests of the data subject to apply those provisions.