What does the legislation say?

What does the legislation say?

Personal data processing is defined as any operation performed on personal data such as collection, recording, organisation, structuring, storage, alteration, use, disclosure by transmission, restriction, erasure or destruction.

Under GDPR Article 9(1), processing of special category data is prohibited, unless we meet a specific condition outlined in Article 9(2).

These conditions are:

• The individual has given explicit consent to the processing. This should be a specific, informed and unambiguous indication of the individuals’ wishes and affirmed in a clear statement, written or oral.
• Processing is necessary in the context of Employment Law, or laws relating to social security and social protection.
• Processing is necessary to protect the vital interests of an individual where they are unable to give consent.
• The processing is carried out in the course of legitimate activities performed by a charity or non-profit-body, with respect of its members, former members or those with whom it has regular contact in connection with its purposes.
• The processing relates to personal data that has been made public by the data subject.
• The processing is necessary for the establishment, exercise or defence or legal claims, or for courts acting in their judicial capacity.
• The processing is necessary for reasons of substantial public interest
• The processing is necessary for the purpose of health and social care
• The processing is necessary for reasons of public interest relating to public health, such as ensuring the safety of medicinal products.
• The processing is necessary for archiving purposes in the public interests for historical, scientific, research or statistical purposes (subject to appropriate safeguards).