Paragraph 4 I1

Changes not yet applied. Later legislation changes this provision in ways not yet written into the text below:

Sch. 3 para. 8(1)(q)(ii) words substituted by Adoption and Children Act (Northern Ireland) 2022 Sch. 3 para. 78(2)(a)
Sch. 3 para. 8(1)(q)(ii) words substituted by Adoption and Children Act (Northern Ireland) 2022 Sch. 3 para. 78(2)(b)
Sch. 3 para. 8(1)(y) added by Adoption and Children Act (Northern Ireland) 2022 Sch. 3 para. 78(3)
Sch. 3 para. 2(1) words substituted by Veterans Advisory and Pensions Committees Act 2023 s. 2(1)(l)

(1)

This paragraph applies where a request for data concerning health is made in exercise of a power conferred by an enactment or rule of law and—

(a)

in relation to England and Wales or Northern Ireland, the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject,

(b)

in relation to Scotland, the data subject is an individual aged under 16 and the person making the request has parental responsibilities for the data subject, or

(c)

the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.

(2)

The listed GDPR provisions do not apply to data concerning health to the extent that complying with the request would disclose information—

(a)

which was provided by the data subject in the expectation that it would not be disclosed to the person making the request,

(b)

which was obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed, or

(c)

which the data subject has expressly indicated should not be so disclosed.

(3)

The exemptions under sub-paragraph (2)(a) and (b) do not apply if the data subject has expressly indicated that he or she no longer has the expectation mentioned there.

Annotations

Commencement

I1: Sch. 3 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)