Explanatory note

“Sensitive personal data” is defined in section 2(g) and (h) of the Data Protection Act 1998 to include information as to the commission or alleged commission by a person of any offence, or any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

The first data protection principle, set out in paragraph 1 of Schedule 1 to the Act, prohibits the processing of “sensitive personal data” unless one of the conditions in Schedule 3 to the Act is met. The condition set out in paragraph 10 of that Schedule is that the personal data are processed in circumstances specified in an order made by the Secretary of State.

This Order specifies that information about a criminal conviction or caution may be processed for the purpose of administering an account relating to the payment card (or for cancelling the payment card) used in the commission of one of the listed offences relating to indecent images of children and for which the data subject has been convicted or cautioned under the relevant legislation in England and Wales, Scotland or Northern Ireland.