Sensitive Personal Data

Section 1 of the Act specifies eight categories of sensitive personal data. These are data consisting of information as to the Data Subject's:

• racial or ethnic origin
• political opinions
• religious or other beliefs of a similar nature
• trade union membership
• physical or mental health or condition
• sexual life
• the commission or alleged commission by him of an offence
• any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings

The very nature of this type of personal information means that it should only be necessary in limited circumstances and for specific purposes to seek this information from an individual. The Act requires that, for the processing of sensitive personal data to be lawful, the data controller must meet a condition set out in Schedule 2 to the Act and a condition set out in Schedule 3. If this cannot be achieved then the processing will be unlawful.

Schedule 2 Conditions

The Schedule 2 Conditions for Processing are:

• the data subject has given consent;
  or the processing is NECESSARY :
• for the performance of a contract to which the data subject is a party
• for the taking of steps at the request of the data subject with a view to entering into a contract
• for compliance with any legal obligation to whic the data controller is subject, other than an obligation imposed by contract
• to protect the vital interests of the data subjects
• for the administration of justice
• for the exercise of any function of Tynwald, the Council or the Keys
• for the exercise of any functions conferred on any person by or under any statutory provision
• for the exercise of any functions of the Crown, a Department or a Statutory Board
• for the exercise of any other functions of a public nature exercised in the public interest by any person
• The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject IF the Council of Ministers makes and order tor specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.

Schedule 3 Conditions

Schedule 3 contains 20 additional conditions for processing sensitive personal data. The most common conditions for processing are:

• explicit consent has been given by the data subject
  or the processing is NECESSARY for the following reasons:
• exercising or performing any right or legal obligation conferred or inposed by law in connection with employment
• to protect the vital interests of the data subject or another person if consent cannot be given by, or on behalf of, the data subject, or the data controller cannot be reasonably expected to obtain the consent of the data subject
• in order to protect the vital interests of another person in a case where consent by, or on behalf of, the data subject has been unreasonably withheld.
• for the purpose of, or in connection with, any legal proceedings, including prospective legal proceedings
• for obtaining legal advice
• establishing, exercising or defending legal rights
• administration of justice
• exercise of any functions of the Keys, the Council, or Tynwald
• exercise of any functions conferred on any person by or under statutory provision
• exercise of any function of the Crown, a Department or a Statutory Board
• for medical purposes and is undertaken by a health professional or a person owing an equivalent duty of confidentiality to a health professional
• substantial public interest
• for the purposes of the prevention or detection of any unlawful act which must necessarily be carried out without the explicit consent of the data subject being sought so as not to prejudice the purposes
• for the exercise of any functions conferred on a constable by any rule of law

Material on the Data Protection Supervisor's site is independent of that hosted by the Isle of Man Government and is protected by copyright. The copyright owner is the Isle of Man Data Protection Supervisor. You may not make alterations or additions to the material on this site, or sell it or misappropriate it. Material may be downloaded or copied for personal use. However, appropriate acknowledgement of the copyright owner is required if material is re-published in any format.