There are a number of exemptions from various provisions of the Act:
- "the subject information provisions" which require data
controllers to inform data subjects of various matters including subject
- "the non-disclosure provisions" which are woven into
Principles numbers 1, 2, 3, 4 and 5 and Sections 10 and 14 of the Act
Exemption from the non-disclosure provisions is available in
circumstances where the Act recognises that the public interest
requires disclosure of personal data which would otherwise be in breach
of the Act. Where an exemption from the non-disclosure provisions
properly applies, such disclosure would not be in breach of the Act.
- The primary exemptions
- national security
- crime and taxation
- health, education and social work
- regulatory activity
- journalistic and artistic (known as special purposes)
- research, history and statistics
- information required by law
- domestic purposes
- The miscellaneous exemptions
- confidential references
- armed forces and judicial appointments
- ministerial appointments
- management forecasting
- corporate finance
- examination scripts (and special clauses for examination results)
- legal priviledge
- self incrimination (not including Data Protection Acts!)
- The transitional exemptions
The primary exemptions
National Security (Section 28)
If required for the purpose of safeguarding national security,
personal data are exempt from any of the provisions of:
- the Data Protection Principles,
- Part II (individuals' rights), Part III (notification) and
Part IV (enforcement) of the Act, and
- Section 55 of the Act (which prohibits the unlawful obtaining
of personal data.
Crime and Taxation (Section 29)
Four categories of exemption:
- the prevention or detection of crime;
- the apprehension or prosecution of offenders;
- the assessment or collection of any tax or duty or of any
imposition of a similar nature;
- risk assessment of tax evasion and fraud.
Health, Education and Social Work (Section 30)
Exemption applies to:
These may be exempt from the subject information provisions
and other provisions of the Act that may be ordered.
- personal data as to the physical or mental health or condition of
the data subject;
- personal data relating to present or past pupils of a school
or teacher; and
- personal data processed by government departments or local
authorities or by voluntary organisations or other designated bodies
and which appear to them to be processed
in the course of or for the purposes of carrying out social work in
relation to the data subject or other individuals.
Regulatory Activity (Section 31)
This provides an exemption from the
subject information provisions numerous public "watch-dogs"
which are all variously concerned with the protection of members
of the public, charities or fair competition in business.
Special purposes exemption (Section 32)
The special purposes means:
- the purposes of journalism;
- artistic purposes;
- literary purposes.
Section 32 of the Act provides four conditions which must all be
present before the processing of personal data
for the special purposes can qualify for exemption from some provisions
of the Act. The conditions are:
- the personal data are processed only for the special purposes;
- the processing is undertaken with a view to the publication
by any person of any journalistic, literary or artistic material;
- the data controller reasonably believes that, taking account
in particular of the special importance of the public interest in
freedom of expression, publication would be in the public interest,
- the data controller reasonably believes that, in all the
circumstances, compliance with the provision in respect of which the
exemption is claimed is incompatible with the special purposes.
If all the above conditions are present, the data are exempt
from various provisions of the Act.
Research, History and Statistics (Section 33)
The processing of personal data for research purposes
(including statistical or historical purposes) is exempt,
provided that the processing is exclusively for those purposes
and, also, that the following conditions are met:
- that the data are not processed to support measures or decisions
relating to particular individuals, and
- that the data are not processed in such a way that substantial
damage or substantial distress is, or is likely to be, caused to any
Where the exemption applies:
- the further processing of personal data will not be considered
incompatible with the purposes for which they were obtained
- personal data may be kept indefinitely despite the fifth
Data Protection Principle, and
- subject access does not have to be given provided that the
results of the research or any resulting statistics are not made
available in a form which identifies data subjects.
Information made available to the public by law
If the data controller is obliged - under any enactment - to make
data available to the public, personal data are exempt from:
- the subject information provisions;
- the fourth Data Protection Principle (accuracy);
- Section 12A of the Act (applicable to exempt manual data
during transitional periods);
- Section 14, sub-sections (1) to (3) of the Act
(rectification, blocking, erasure and destruction); and
- the non-disclosure provisions.
Where the disclosure is required by or under any enactment,
by any rule of law or by the order of a court, personal
data are exempt from the non-disclosure provisions.
Personal data are exempt from the non-disclosure provisions,
where the disclosure is necessary for court cases.
This is a wide-ranging exemption whereby personal data are
exempt from the Data Protection Principles and the provisions of Part II (individual
rights) and Part III (notification) of the Act where they are processed by an
individual only for the purposes of that individual's personal, family or household
affairs (including recreational purposes).
It should be noted that the exemption does not extend to
Part V of the Act which deals with enforcement by the Commissioner.
The miscellaneous exemptions
Various other exemtptions are available, such as confidential references,
and judicial and ministerial appointments.
An important exemption is available to businesses
to protect confidentiality of personal data processed for the purposes of management
forecasting or management planning. In any case, to the extent that the application
of any of the subject information provisions to personal data processed for
such purposes would be likely to prejudice the conduct of the business or other
activity of the data controller, such personal data are exempt from the
subject information provisions.
Examination scripts are also exempt from subject access.
Schedule 8 of the Act sets out when the various requirements will come into effect.
What you read here is only a summary to introduce the concepts. You should
not rely on it to build a legal case or safeguard your legal position.
The University of Glamorgan and its employees cannot be held responsible for
any legal or other redress due to errors in the notes. Seek professional
legal advice before acting on what you read here.