Schedule 3Data Protection Law, 2017
FIRST PRINCIPLE - CONDITIONS FOR PROCESSING OF SENSITIVE PERSONAL DATA
1The data subject has given consent to the processing of the personal data.
2The processing is necessary for the purposes of exercising or performing a right, or obligation, conferred or imposed by law on the data controller in connection with the data subject’s employment.
3The processing is necessary —
(a)in order to protect the vital interests of the data subject or another person, in a case where consent cannot be given by or on behalf of the data subject, or the data controller cannot reasonably be expected to obtain the consent of the data subject; or
(b)in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld.
4The processing —
(a)is carried out in the course of its legitimate activities by a body, or association, that is not established or conducted for profit, and exists for political, philosophical, religious or trade union purposes;
(b)is carried out with appropriate safeguards for the rights and freedoms of data subjects;
(c)relates only to data subjects who are members of the body or association or have regular contact with it in connection with its purposes; and
(d)does not involve disclosure of the personal data to a third party without the consent of the data subject.
5The information contained in the personal data has been made public as a result of steps taken by the data subject.
6The processing —
(a)is necessary for the purpose of, or in connection with, any legal proceedings;
(b)is necessary for the purpose of obtaining legal advice; or
(c)is otherwise necessary for the purposes of establishing, exercising or defending legal rights.
7The processing is necessary for —
(a)the administration of justice;
(b)the exercise of any functions conferred on any person by or under an enactment; or
(c)the exercise of any functions of the Crown or any public authority.
8
(1)The processing is necessary for medical purposes and is undertaken by —
(a)a health professional; or
(b)a person who, in the circumstances, owes a duty of confidentiality equivalent to that which would arise if that person were a health professional.
(2)In this paragraph, “medical purposes” includes the purposes of preventative medicine, medical diagnosis, the provision of care and treatment and the management of healthcare services.
9The personal data are processed in such circumstances as may be prescribed by regulations.
10The Cabinet may by regulations —
(a)exclude the application of paragraph 2 or 7 in such cases as may be specified; or
(b)provide that, in such cases as may be specified, the conditions in paragraph 2 or 7 shall not be regarded as satisfied unless such further conditions, as may be specified in the regulations, are also satisfied.