Conditions for processing personal data
To comply with the first data protection principle, the processing must meet a "condition" for processing. It would contravene the first principle to collect and process personal data without meeting at least one of the conditions.
The conditions for processing personal data are set out in Schedule 2 and Schedule 3 to the Act.
An organisation must meet at least one condition for processing personal data set out in Schedule 2.
In the case of the processing of "sensitive personal data", a condition set out in Schedule 3 must also be met.
Schedule 2 conditions
In summary these are:
- The data subject consents to the processing (please see our advice below on consent)
- the processing is NECESSARY
- in relation to a contract which the individual has entered into
- because the individual has asked for something to be done so they can enter into a contract
- because of a legal obligation that applies to the organisation (except an obligation imposed by contract)
- to protect an individual's "vital interests" i.e. life and death circumstances
- in the legitimate interests of the organisation so long as the rights and freedoms of the data subjects are not prejudiced;
- where the processing is necessary for the administration of justice;
- for the exercise of any functions of Tynwald, the Council or the Keys;
- for the exercise of functions conferred by or under a statutory provision;
- for the exercise of any functions of the Crown, a Department or Statutory Board
- for the exercise of any other functions of a public nature exercised in the public interest.
Schedule 3 conditions
These conditions are more exacting, but if there is a legitimate reason to process personal data, then it will be relatively straightforward to identify which condition for processing is met.
The following is a summary of the conditions for processing sensitive personal data. However, it is only intended as a basic guide and any data controller who processes sensitive personal data should refer directly to Schedule 3 of the Act for a full description of all the conditions.
- the individual has given their explicit consent
- to comply with employment law
- to protect vital interests of
- the individual (in a case where the individual's consent cannot be given or reasonably obtained)
- another person (in a case where the individual's consent has been unreasonable withheld)
- where the data have been made public by the individual
- in connection with legal proceedings, or for obtaining legal advice
- for medical purposes and the processing is undertaken by a health professional or by an individual who owes an equivalent duty of confidentiality
- for the administration of justice / statutory functions including Tynwald, Council or the Keys
- any other purposes specified by Council of Ministers