The Data Protection (Processing of Sensitive Personal Data) Order 2000

This Order amends the Data Protection Act 1998 and provides for sensitive personal data (for example information relating to physical or mental health).

The Order

The order may be lawfully processed without explicit consent where there is a substantial public interest in disclosing the data for any of the following purposes:

  • for the detection and prevention of crime
  • for the protection of members of the public against malpractice, incompetence, mismanagement etcetera
  • to publicise the fact of malpractice, incompetence, mismanagement etcetera, for the protection of the public
  • to provide confidential counselling and advice where explicit consent cannot be given nor reasonably obtained, or where the processing must be carried out without explicit consent so as not to prejudice that confidential counselling or advice
  • to undertake research that does not support measures or decisions with respect to any particular data subject unless the data subject has explicitly consented and does not cause, nor is likely to cause, substantial damage or substantial distress to the data subject or any other person

Sensitive personal data may also be lawfully processed where:

  • the information relates to the data subject or to specific relatives of the data subject and the processing is for the purposes of administering defined insurance business or occupational pensions schemes
  • the processing is carried out by a person authorised under the Registration of Political Parties Act 1998 in the course of their legitimate political business as long as the processing does not cause, nor is likely to cause, substantial damage or substantial distress to the data subject or any other person
  • the processing is necessary for the exercise of any functions conferred on a constable by any rule of law

The Data Protection (Processing of Sensitive Personal Data) Order 2000

Related articles

Back to top