PART IV EXEMPTIONS
Part IV of the DPA contains exemptions from the ‘subject information provisions’ and the ‘non-disclosure provisions’. The exemptions from the subject information provisions, which are essentially exemptions from the transparency provisions of the DPA, were discussed in Chapter 2. This section deals with the exemptions from the non-disclosure provisions.
The non-disclosure provisions
The disclosure of personal data is an act of processing and section 27 identifies the non-disclosure provisions of the DPA to be:
The first data protection principle’s requirement for fair and lawful processing. However, the first data protection principle’s requirement for the data controller to satisfy a Schedule 2 or Schedule 3 condition does not form part of the non-disclosure provisions.
The second, third, fourth and fifth data protection principles.
Section 10, which contains the data subject’s right to object to processing likely to cause substantial and unwarranted damage or distress.
Section 14(1) to (3), which empowers the court to order the rectification, blocking, erasure or destruction of inaccurate personal data and the notification of the fact of rectification, blocking, erasure or destruction to third-party recipients of the personal data.
Where Part IV contains an exemption from the non-disclosure provisions, these provisions will not apply to the processing in question. As explained in Chapter 2, section 36 of the DPA contains a complete exemption for processing done for domestic purposes and section 28 creates the possibility of an equally comprehensive exemption where such an exemption is required ‘for the purposes of safeguarding national security’. It should also be remembered that the exemptions in Part IV fall into two categories: prejudice-based exemptions and class-based exemptions.
Table 3.1 lists the subject information provisions and the non-disclosure provisions.
| Subject information provisions | Non-disclosure provisions |
|---|---|
| The first data protection principle, apart from the prescribed information | The first data protection principle, apart from the requirement to show a Schedule 2 or 3 criterion for legitimacy. |
| Section 7 – The data subject’s right of access | The second data protection principle. |
| The third data protection principle. | |
| The fourth data protection principle. | |
| The fifth data protection principle. | |
| Section 10 – the right to prevent processing likely to cause substantial and unwarranted damage or distress. | |
| Sections 14(1)–(3) – The court’s power to order rectification etc. of inaccurate data. |
Crime and taxation
Where the processing is for the purposes of the prevention or detection of crime, the apprehension or prosecution of offenders, the assessment or collection of any tax or duty the non-disclosure provisions will not apply if they would be likely to prejudice any of these functions.
Journalism, literature and art (the special purposes)
The non-disclosure provisions do not apply where the processing is for the special purposes. The conditions to be satisfied are the same as those identified in Chapter 2. It should also be noted that the exemption in section 32 extends further than the subject information provisions and the non-disclosure provisions, because the first data protection principle is excluded in its entirety as are the sixth and eighth data protection principles and section 12 (the right to object to automated decision taking).
Manual data held by public authorities
In addition to the exemptions identified in Chapter 2 and in addition to the non-disclosure provisions (the fourth data protection principle excluded) the exemptions for processing by way of recorded information held by public authorities extends to the whole of the first data protection principle, to the seventh data protection principle, to the eighth data protection principle, to section 11 (the right to object to processing for direct marketing purposes), section 12, section 13 (apart from where damage is caused as a result of a breach of section 7, or where distress is caused as a result of a breach of the fourth data protection principle), to Part III (notification) and to section 55 (unlawful obtaining or disclosure of personal data).
Information available to the public under an enactment
In the same circumstances described in Chapter 2, section 34 of the DPA also contains an exemption from the non-disclosure provisions.
Disclosures required by law or made in connection with legal proceedings
Section 35 of the DPA contains an exemption from the non-disclosure provisions in the following circumstances:
where disclosure is required under an enactment, by any rule of law or by order of a court;
where the disclosure is required for the purposes of, or in connection with, any legal proceedings, or prospective legal proceedings;
where the disclosure is necessary for the purpose of obtaining legal advice;
where the processing is necessary for the purposes of establishing, exercising or defending legal rights.
The subject information provisions are not excluded under section 35.
Parliamentary privilege
In the same circumstances as described in Chapter 2, section 35A also contains an exemption from the non-disclosure provisions in addition to the exemption from section 7.