OpenLegislation

Regulation 45 Sensitive information

United Kingdom

Changes not yet applied. Later legislation changes this provision in ways not yet written into the text below:

(1)

In these Regulations, “sensitive information” means information which is –

(a)

information the disclosure of which to the public would, or would be likely to, adversely affect national security;

(b)

information the disclosure of which to the public would, or would be likely to, adversely affect public safety;

(c)

information disclosure of which to the public would, or would be likely to, prejudice the commercial interests of any person; or

(d)

information which is personal data F1... if the condition in paragraph F2(1A), (1B) or (1C) is satisfied.

F3(1A)

The condition in this paragraph is that the disclosure of the information to a member of the public—

(a)

would contravene any of the data protection principles, or

(b)

would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

(1B)

The condition in this paragraph is that the disclosure of the information to a member of the public would contravene—

(a)

Article 21 of the F4UK GDPR (general processing: right to object to processing), or

(b)

section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).

(1C)

The condition in this paragraph is that—

(a)

on a request under Article 15(1) of the F5UK GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018,

(b)

on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or

(c)

on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.

(1D)

In this regulation—

  • “the data protection principles” means the principles set out in—

    1. (a)

      Article 5(1) of the F6UK GDPR ,

    2. (b)

      section 34(1) of the Data Protection Act 2018, and

    3. (c)

      section 85(1) of that Act;

  • F7...

  • “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).

  • F8“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

(1E)

In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the F9UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests F10gateways in relation to public authorities) F11disapplied only the gateway in point (ea) (recognised legitimate interests).

F12(2)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Annotations

Textual amendments

F1

Words in reg. 45(1)(d) omitted (25.5.2018) by virtue of Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 317(2)(a) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F2

Words in reg. 45(1)(d) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 317(2)(b) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F3

Reg. 45(1A)-(1E) inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 317(3) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F4

Words in reg. 45(1B)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 60(2) (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)

F5

Words in reg. 45(1C)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 60(2) (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)

F6

Words in reg. 45(1D) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 60(3)(a) (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)

F7

Words in reg. 45(1D) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 60(3)(b) (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)

F8

Words in reg. 45(1D) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 60(3)(c) (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)

F9

Words in reg. 45(1E) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 60(4) (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)

F10

Word in reg. 45(1E) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 70(8)(a)(9)(e), 142(1); S.I. 2026/82, reg. 2(c)

F11

Words in reg. 45(1E) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 70(8)(b)(9)(e), 142(1); S.I. 2026/82, reg. 2(c)

F12

Reg. 45(2)-(4) omitted (25.5.2018) by virtue of Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 317(4) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)