Schedule 1: Special categories of personal data and criminal convictions etc data Part 2 – Substantial public interest conditions
This Part relates to Article 9(2)(g) of the GDPR and sets out the conditions for processing of special categories of data which are necessary for reasons of substantial public interest. The majority of these processing conditions existed in or under Schedule 3 to the 1998 Act and the effect of those conditions is retained, with adjustments, in this Act.
	Paragraph 5 makes it a condition of processing under this Part for the data controller to have appropriate safeguards in place as set out in Part 4.
	Paragraph 6 permits processing of special categories of data that is in the substantial public interest and is necessary for the exercise of a function conferred on a person by an enactment or rule of law; or the exercise of a function of the Crown, a Minister of the Crown or a Government department.
	Paragraph 7 permits processing that is necessary for the administration of justice or for the exercise of a function of either House of Parliament.
	Paragraph 8 permits processing of personal data revealing health or ethnic origin, personal data revealing religious or philosophical beliefs, data concerning health and personal data concerning an individual’s sexual orientation for the monitoring of equality between persons with different racial or ethnic origins, different religious or philosophical beliefs, differing physical or mental health conditions or between persons of different sexual orientation. Processing does not meet this condition if it is carried out for the purposes of measures or decisions with respect to the particular data subject unless the data subject has consented. Processing also does not meet this condition if it is likely to cause substantial damage or distress to the data subject. An individual can give notice in writing to the controller requiring the controller to cease processing his or her data, and the processor must cease processing within a reasonable period.
	Paragraph 9 permits processing of special categories of data necessary for the purposes of promoting or maintaining diversity in the racial and ethnic origins of individuals who hold senior positions in organisations where the processing can reasonably be carried out without the consent of the data subject and the processing does not cause substantial damage or substantial distress to an individual.
	Paragraph 10 permits processing of special categories of data for the purposes of the prevention or detection of any unlawful act where it is necessary for reasons of substantial public interest or where seeking the consent of the data subject to the processing would prejudice those purposes, which would cover a situation where giving the data subject a choice or giving them the necessary information required for valid consent would prejudice the purpose, or where valid consent is not possible because a refusal to consent could cause detriment.
	Paragraph 11 permits processing of special categories of data which is necessary for the purposes of discharging certain protective functions which are designed to protect members of the public from certain conduct which may not constitute an unlawful act, such as dishonesty, incompetence or mismanagement. Additional requirements are that the processing is necessary for reasons of substantial public interest and seeking the consent of the data subject would prejudice those purposes, which would cover a situation where giving the data subject a choice or giving them the necessary information required for valid consent would prejudice the purpose, or where valid consent is not possible because a refusal to consent could cause detriment.
	Paragraph 12 permits processing of special categories of data for the purposes of complying with, or assisting others to comply with, a regulatory requirement relating to unlawful acts, dishonesty etc. This paragraph allows private companies (in particular in the financial services sector) to process special categories of personal data where necessary to screen against UK laws such as the Proceeds of Crime Act 2002 to help financial institutions identify customers suspected of money laundering, and this paragraph further permits processing to screen against other regulatory requirements including widely-recognised sectoral guidelines such as those promulgated by the Financial Action Task Force. Additional requirements are that the controller cannot reasonably be expected to obtain the consent of the data subject to the processing and the processing is necessary for reasons of substantial public interest.
	Paragraph 13 permits processing of special categories of data which is necessary for the disclosure of data for journalism, academic, artistic or literary purposes where the subject matter of the disclosure relates to the matters mentioned in sub-paragraph (2) (unlawful acts; dishonesty, malpractice or other seriously improper conduct; unfitness or incompetence, mismanagement or a failure in services). The disclosure must be carried out with a view to the publication of the personal data by any person and it must be necessary for reasons of substantial public interest. In addition, the controller must reasonably believe that publication of the personal data would be in the public interest.
	Paragraph 14 permits the processing of special categories of data where the disclosure is necessary for preventing fraud, or a particular type of fraud, and is by a member of an anti-fraud organisation (as defined in the Serious Crime Act 2007) or in accordance with arrangements made by an anti-fraud organisation. The processing of any data so disclosed is permitted.
	Paragraph 15 permits processing of special categories of data which is necessary for the purposes of making a disclosure in good faith under section 21CA of the Terrorism Act 2000 (terrorist financing and identifying terrorist property) or section 339ZB of the Proceeds of Crime Act 2002 (money laundering).
	Paragraph 16 permits processing of special categories of data by a not-for-profit body which provides support to individuals with a particular disability or medical condition, for the purpose of raising awareness of the disability or medical condition, or assisting those affected by it. This includes the work undertaken by patient support groups. These are groups who provide services to those suffering from (typically rare) diseases or other medical conditions. Additional requirements are that the processing can reasonably be carried out without the consent of the data subject and that it is necessary for reasons of substantial public interest.
	Paragraph 17 permits processing of special categories of data required to discharge functions involving the provision of services such as confidential counselling and advice in circumstances where the processing is necessary for reasons of substantial public interest and the consent of the data subject is not obtained for one of the specified reasons set out in sub-paragraph (2).
	Paragraph 18 permits processing of special categories of data required for the protection of children or of adults at risk. This makes is clear that front-line practitioners and others can lawfully process personal data by retaining records and sharing information where necessary, for the purpose of safeguarding children and vulnerable adults. The processing must be necessary for reasons of substantial public interest and must be carried out without the consent of the data subject for one of the specified reasons.
	Paragraph 19 permits processing of special categories of data which is necessary to protect the economic well-being of adults who are less able to protect their own economic well-being by reason of a physical or mental injury, illness or disability where the processing is necessary for reasons of substantial public interest and is carried out without the consent of the data subject for one of the specified reasons.
	Paragraph 20 permits processing of data concerning health, or data revealing racial or ethnic origin, religious or philosophical beliefs or trade union membership, or genetic data where it is necessary for an insurance purpose and is necessary for reasons of substantial public interest.
	Sub-paragraphs (2), (3) and (4) provide specific safeguards for those data subjects who: (i) do not have rights or obligations in connection with the insurance contract or the insured person, and (ii) where the processing is not carried out for the purpose of measures or decisions with respect to them. For example, a witness to an event giving rise to an insurance claim or a sibling of a person seeking health insurance might fall into this category. Processing of data relating to these data subjects is only permitted if the data controller cannot reasonably be expected to obtain the consent of the data subject and they are not aware of the data subject withholding their consent.
	"Insurance purpose" is defined in sub-paragraph (5). The definition includes: processing necessary for advising on, arranging, underwriting or administering an insurance contract and processing necessary for administering a claim under an insurance contract or against the Motor Insurers’ Bureau. Processing necessary for exercising a right or obligation arising under an enactment or rule of law, such as subrogated rights, is also included. Sub-paragraph (6) further clarifies the definition of "insurance contract".
	Paragraph 21 permits processing of special categories of data in certain occupational pension scheme contexts and the processing can reasonably be carried out without the consent of the data subject. The data controller or processor must not process personal data to make decisions or take actions with respect to the data subject nor if he or she is aware of the data subject withholding their consent to the processing.
	Paragraph 22 permits the processing of data revealing political opinions by persons or organisations included in the register under section 23 of the Political Parties, Elections and Referendums Act 2000, provided such processing does not cause substantial damage or substantial distress to a person. The processing must be necessary for the purpose of the person or organisation’s political activities, which include political campaigning, fundraising, political surveys and casework. An individual can give notice in writing to the controller requiring the controller to cease processing his or her data, and the controller must cease processing within a reasonable period.
	Paragraph 23 permits processing of special categories of data by elected representatives responding to requests where it is carried out by an elected representative or a person acting with his or her authority. The processing must be in connection with the discharge of the functions of the elected representative and the condition is only met if the processing must be carried out without the data subject’s consent for one of the reasons specified in sub-paragraph (2). "Elected representative" is defined in sub-paragraph (3).
	Paragraph 24 permits the disclosure of special categories of data to an elected representative or a person acting with the authority of such a representative and in response to a communication to the controller from that representative or person which was made in response to a request from an individual. The disclosure must be necessary for the purpose of responding to the subject matter of the communication, the personal data must be relevant to the subject matter of the communication, and the processing must be carried out without the data subject’s consent for one of the reasons specified in sub-paragraph (2).
	Paragraph 25 allows the processing of special categories of data about a prisoner, including information relating to the prisoner’s release from prison, for the purpose of informing a member of the House of Commons, a member of the National Assembly for Wales or a member of the Scottish Parliament about the prisoner and arrangements for the prisoner’s release. The member must be under an obligation not to further disclose the data.
	Paragraph 26 allows the processing of special categories of data where the processing consists of the publication of a judgment or other decision of a court or tribunal, or is necessary for the purposes of publishing such a judgment or decision.
	Paragraph 27 permits bodies who are responsible for monitoring or eliminating doping in a sport or sporting event, to undertake processing of special categories of data necessary for those purposes.
	Paragraph 28 permits processing that is necessary for the purposes of measures designed to protect the integrity of a sport or sporting event. Sub-paragraph (2) lists the behaviours and activities which this condition is attempting to protect against in sport or sporting events. These include: dishonesty, malpractice or other seriously improper conduct, or a failure by a person participating in the sport or event in any capacity to comply with standards of behaviour set by a body or association with responsibility for the sport or sporting event. The processing must be in the substantial public interest. It must also be necessary to carry out the processing without the consent of the data subject so as not to prejudice the purposes designed to protect the integrity of a sport or sporting event, which would cover a situation where giving the data subject a choice or giving them the necessary information required for valid consent would prejudice the purpose, or where valid consent is not possible because a refusal to consent could cause detriment.