The ICO has published an updated edition of its guidance "Using the crime and taxation exemptions". Data controllers can disclose personal data without applying some aspects of the data protection principles, if the disclosure is necessary for crime prevention and taxation purposes. More specifically, Data controllers do not have to fulfil their obligations to tell individuals how their data is being processed or respond to a subject access request if doing so would prejudice the crime prevention and taxation purposes.
The guidance suggests a 3 stage test to assessing whether the exemption applies:
- Identify the prejudice that would occur if the DPA was followed in the usual way;
- Establish a causal link between the use of the data and the prejudicial effect;
- The Data controller must demonstrate that failing to apply the exception would be likely to cause the prejudice identified.
The guidance contains a number of useful worked case studies. It also contains useful guidance on the applicability of the Schedule 2 and Schedule 3 processing conditions. The crime and taxation exemption does not provide an exemption from satisfying a Schedule 2 processing condition for the processing of personal data and in addition a Schedule 3 processing condition for the processing of sensitive personal data.
The ICO is of the view that if the 3 stage test set out above is satisfied, the relevant processing conditions are Schedule 2, paragraph 5, and Schedule 3, paragraph 7:
The processing is necessary—.
(a) for the administration of justice,.
(b) for the exercise of any functions conferred on any person by or under an enactment, or.
(c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department.
(d) [for the exercise of any other functions of a public nature exercised in the public interest by any person].*
* This limb does not feature in the Schedule 3 equivalent.
This is an interesting stance taken by the ICO. When insurers are exchanging personal data for the purposes of establishing or detecting fraudulent claims, a more appropriate processing condition is, in the author's view, Schedule 2 paragraph 6 (legitimate interests without causing undue prejudice) and Schedule 3 paragraph 6 (necessary for the purposes of establishing, exercising or defending legal rights) as it would be difficult to shoe-horn such disclosures into the condition identified by the ICO.
To view the ICO guidance – "Using the crime and taxation exemptions" please click here.
To view the ICO's blog on the release of the updated guidance, please click here.