Personal data which falls into one of these categories is defined as sensitive personal data:
- Racial or ethnic origin of the data subject;
Political opinions or affiliation;
Religious beliefs or other beliefs of a similar nature;
Whether the data subject is a member of a trade union;
Physical or mental health or condition;
Sexual life;
The commission or alleged commission by them of an offence;
Any proceedings for any offence committed or alleged to have been committed by them, the disposal of such proceedings, or the sentence of any court in such proceedings.
In order to be lawful, the processing of sensitive personal data must meet at least one of a list of 19 conditions (in addition to the personal data conditions). Only those conditions which might be relevant in a local authority setting are listed below:
The data subject has given their explicit consent to the processing of the sensitive personal data.
The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment.
The processing is necessary:
in order to protect the vital interests of the data subject or another person where consent cannot be given by or on behalf of the data subject, or the data controller cannot reasonably be expected to obtain the consent of the data subject; or
in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld.
This condition should only be relied on in cases where the protection of vital interests involves a life and death situation.
The processing:
is carried out in the course of its legitimate activities by any body or association which exists for political, philosophical, religious or trade union purposes and which is not established or conducted for profit;
is carried out with appropriate safeguards for the rights and freedoms of data subjects;
relates only to individuals who are either members of the body or association or who have regular contact with it in connection with its purposes; and
does not involve disclosure of the personal data to a third party without the consent of the data subject.
- The sensitive personal data has been made public as a result of steps deliberately taken by the data subject.
The processing:
is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings);
is necessary for the purpose of obtaining legal advice; or
is otherwise necessary for the purpose of establishing, exercising or defending legal rights.
The processing is necessary:
for the administration of justice;
for the exercise of any function conferred by or under any enactment; or
for the exercise of any function of the Crown, a Minister of the Crown, or a government department.
The processing is necessary for medical purposes and is undertaken by:
The processing:
is of sensitive personal data consisting of information as to racial or ethnic origin, physical or mental health or condition, or religious beliefs or other beliefs of a similar nature;
is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons of different racial or ethnic origins, different physical or mental health conditions, or different religious beliefs or beliefs of a similar nature, with a view to enabling such equality to be promoted or maintained; and
is carried out with appropriate safeguards for the rights and freedoms of data subjects.
The processing is undertaken for the purposes of the prevention or detection of any unlawful act, where it is "in the substantial public interest" and seeking consent would prejudice these purposes. The term "in the substantial pubic interest" is not defined in the legislation.
The processing is undertaken for research purposes where it is "in the substantial pubic interest", the data is not to be used to take decisions about an individual without their consent, and no substantial damage or distress will be caused to the individual.