Schedule 2: Exemptions etc from the GDPR Part 3 – Restriction based on Article 23(1): protection of rights of others
Paragraphs 16 and 17 provide that a data controller is not obliged to disclose information under Article 15 of the GDPR if to do so would mean disclosing information relating to another individual who can be identified from the information, except where there the other individual has consented; or it is reasonable in all circumstances to comply with the request without that individual's consent. This retains the effect of sections 7(4), (5), (6) and 8(7) of the 1998 Act.