Data Protection Policy

Appendix C - Exemptions

Below provides a summary of the exemptions in the Data Protection Act 2018 (reference to the relevant part of the Act) from the relevant articles of the UK GDPR.

For ease of reference, the relevant UK GDPR Articles are:

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 16: Right of rectification
• Article 17: Right of erasure
• Article 18: Right to rectification of processing
• Article 19: Notification regarding rectification, erasure or restriction
• Article 20: Right of data portability
• Article 21: Right to object

Crime and Taxation: general (Schedule 2, Paragraph 2)

Exemption for the purposes of the prevention or detection of crime, the apprehension or prosecution of offenders or the assessment or collection of tax or duty.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 16: Right of rectification
• Article 17: Right of erasure
• Article 18: Right to rectification of processing
• Article 20: Right of data portability
• Article 21: Right to object

Crime and Taxation: risk assessment system (Schedule 2, Paragraph 3)

Exemption for personal data which consists of a classification applied to a data subject as part of a risk assessment system operated by government, local authority or another authority administering housing benefit for crime and taxation purposes.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access

Immigration (Schedule 2, Paragraph 4)

Exemption for the purposes of the maintenance of effective immigration control, or the investigation or detection of activities that would undermine the maintenance of effective immigration control.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 17: Right of erasure
• Article 18: Right to rectification of processing

Information required to be disclosed by law etc or in connection with legal proceeding (Schedule 2, Paragraph 5)

Exemption if:

• The controller is obliged by enactment to make personal data available to the public;
• Disclosure is required by an enactment, rule of law or court/tribunal order: or
• Disclosure is necessary for the purposes of actual or prospective legal proceedings, or obtaining of legal advice or establishing, exercising or defending legal rights.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 16: Right of rectification
• Article 17: Right of erasure
• Article 18: Right to rectification of processing
• Article 20: Right of data portability
• Article 21: Right to object

Functions designed to protect the public etc. (Schedule 2, Paragraph 7)

Exemption for the purposes of certain bodies or persons discharging functions, including:

• To protect the public in relation to financial loss, harm by persons authorised to carry on any professions or other activity;
• To protect charities and community interest companies and their property from mishandling;
• To protect the health and safety of persons at work or other persons in connection with the action of persons at work;
• To protect the public from maladministration and failures by a public body and to regulate anti-competitive behaviour.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 16: Right of rectification
• Article 17: Right of erasure
• Article 18: Right to rectification of processing
• Article 20: Right of data portability
• Article 21: Right to object

Regulatory functions relating to legal services, the health service and children’s services (Schedule 2, Paragraph 8)

Exemption for the purpose of certain bodies or persons discharging functions relating to the Legal Services Board, considering legal complaints, complaints as to the maladministration of a health service redress scheme by anybody or other person, complaints relating to social and palliative care and complaints about social services.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 16: Right of rectification
• Article 17: Right of erasure
• Article 18: Right to rectification of processing
• Article 20: Right of data portability
• Article 21: Right to object

Regulatory function of certain other bodies (Schedule 2, Paragraph 9)

Exemption for the purpose of certain bodies or persons discharging functions relating to the Financial Ombudsman, the investigator of complaints against the financial regulators, a consumer protection officer other than the Competition and Markets Authority, the monitoring officer of a relevant authority and the Public Services Ombudsman for Wales.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 16: Right of rectification
• Article 17: Right of erasure
• Article 18: Right to rectification of processing
• Article 20: Right of data portability
• Article 21: Right to object

Parliamentary Privilege (Schedule 2, Paragraph 11)

Exemption if this is required for the purpose of avoiding an infringement of parliamentary privilege.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 16: Right of rectification
• Article 17: Right of erasure
• Article 18: Right to rectification of processing
• Article 20: Right of data portability
• Article 21: Right to object

Protection of the Rights of Others (Schedule 2, Paragraph 14)

Exemption if a disclosure of information by a controller would involve disclosing information relating to another individual identifiable from the information.

• Article 5: the Principles
• Article 15: Subject access

Legal Professional Privilege (Schedule 2, Paragraph 17)

Exemption for information subject to legal professional privilege.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access

Self-Incrimination (Schedule 2, Paragraph 20)

Exemption from certain UK GDPR provisions where compliance would reveal evidence of the commission of an offence and would expose that person to proceedings for that offence.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access

Confidential References (Schedule 2, Paragraph 22)

Exemption if the personal data consists of a confidential reference for purposes including the education, training or employment of the data subject. This exemption also applies to the appointment of the data subject to any office, including that of a volunteer, or the provision of any service by the data subject.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access

Exam Scripts and Exam Marks (Schedule 2, Paragraph 23)

Exemption when personal data consisting of information recorded by candidates during an exam.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access

Research and Statistics (Schedule 2, Paragraph 25)

Exemption if personal data is processed for scientific or historical research purposes, or for statistical purposes.

• Article 15: Subject access
• Article 16: Right of rectification
• Article 18: Right to rectification of processing
• Article 19: Notification regarding rectification, erasure or restriction
• Article 20: Right of data portability
• Article 21: Right to object

Archiving in the Public Interest (Schedule 2, Paragraph 26)

Exemption if personal data is processed for archiving purposes in the public interest.

• Article 15: Subject access
• Article 16: Right of rectification
• Article 18: Right to rectification of processing
• Article 19: Notification regarding rectification, erasure or restriction
• Article 20: Right of data portability
• Article 21: Right to object

Health Data Processed by a Court (Schedule 3, Paragraph 3)

Exemption if health personal data is processed by a Court

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 16: Right of rectification
• Article 17: Right of erasure
• Article 18: Right to rectification of processing
• Article 20: Right of data portability
• Article 21: Right to object

Data Subject Expectations and Wishes with Respect to Health Data (Schedule 3 Paragraph 4)

Exemption relating to a request for health data in certain situations where the data subject is under 18 years old and the requestor has parental responsibility or the data subject is incapable of managing their own affairs and responding to the request would not conform with the data subjects wishes.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 16: Right of rectification
• Article 17: Right of erasure
• Article 18: Right to rectification of processing
• Article 20: Right of data portability
• Article 21: Right to object

Serious Harm from Health Data Disclosure (Schedule 3, Paragraph 5)

Exemption from Article 15 (1) and (3) when the serious harm test is met or where a controller who is not a health professional obtains an opinion from someone who appears to be an appropriate health professional.

• Article 15: Subject access

* The Serious Harm Test involves consideration of whether the application of the Article 15 Right of Access under the UK GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.

Social Work Data Processed by a Court (Schedule 3, Paragraph 9)

Exemption if personal data concerning social work is processed by the Court.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 16: Right of rectification
• Article 17: Right of erasure
• Article 18: Right to rectification of processing
• Article 20: Right of data portability
• Article 21: Right to object

Data Subjects Expectations and Wishes with Respect to Social Work Data (Schedule 3, Paragraph 10)

Exemption relating to a request for social work data in certain situations where the data subject is under 18 years old and the requestor has parental responsibility or the data subject is incapable of managing their own affairs and responding to the request would not conform with the data subject’s wishes.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 16: Right of rectification
• Article 17: Right of erasure
• Article 18: Right to rectification of processing
• Article 20: Right of data portability
• Article 21: Right to object

Serious Harm from Social Work Data Disclosure (Schedule 3, Paragraph 11)

Exemptions from Article 15 (1) and (3) of the UK GDPR when the serious harm test is met.

• Article 15: Subject access

* The Serious Harm Test involves consideration of whether the application of the Article 15 Right of Access under the UK GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.

Education Data Processed by Court (Schedule 3, Paragraph 18)

Exemption if educational personal data is processed by the Court.

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 16: Right of rectification
• Article 17: Right of erasure
• Article 18: Right to rectification of processing
• Article 20: Right of data portability
• Article 21: Right to object

Serious Harm from Education Data Disclosure (Schedule 3, Paragraph 19)

Exemption from Article 15 (1) and (3) when the serious harm test is met.

• Article 15: Subject access

* The Serious Harm Test involves consideration of whether the application of the Article 15 Right of Access under the UK GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.

Child Abuse Data (Schedule 3, Paragraph 21)

Exemption from Article 15 (1) and (3) when a request for child abuse data would not be in the best interests of the data subject under 18 years old and the requestor has parental responsibility or the data subject is incapable of managing their own affairs and the person making the request has been appointed by a court to manage those affairs.

• Article 15: Subject access

Journalistic, Academic, Artistic and Literary Purposes (Schedule 2, Paragraph 24)

Exemption from certain UK GDPR provisions if the personal data is being processed for the special purposes with a view to publication by a person of journalistic, academic, artistic and literary material in the public interest. (Also exempt from Articles 60-67)

• Article 5: the Principles
• Article 13: Transparency information when collecting personal data directly
• Article 14: Transparency information when not collecting personal data directly
• Article 15: Subject access
• Article 16: Right of rectification
• Article 17: Right of erasure
• Article 18: Right to rectification of processing
• Article 19: Notification regarding rectification, erasure or restriction
• Article 20: Right of data portability
• Article 21: Right to object

Other

Exemption from certain UK GDPR provisions if personal data is processed for the following purposes, when disclosing information about:

• Human fertilisation and embryology information (Schedule 4, Paragraph 2);
• Adoption records and reports (Schedule 4, Paragraph 3);
• Statements of special educational needs (Schedule 4, Paragraph 4);
• Parental order records and reports (Schedule 4, Paragraph 5);
• Information provided by the Principle Reporter for children’s hearing (Schedule 4, Paragraph 6).

• Article 5: the Principles
• Article 15: Subject access

There are additional exemptions available for the following specific circumstances:

• When assessing a person’s suitability for judicial office or the office of Queen’s Counsel;
• When assessing a person’s suitability for offices such as the Poet Laureate;
• In connection with a corporate finance service involving price-sensitive information;
• Management forecasting or planning in relation to a business or other activity;
• Any negotiations with the data subject and where this would be likely to prejudice those negotiations.