Data Protection Act 1988
F11 [ Processing of personal data.
2A. — (1) Personal data shall not be processed by a data controller unless section 2 of this Act (as amended by the Act of 2003) is complied with by the data controller and at least one of the following conditions is met:
( a ) the data subject has given his or her consent to the processing or, if the data subject, by reason of his or her physical or mental incapacity or age, is or is likely to be unable to appreciate the nature and effect of such consent, it is given by a parent or guardian or a grandparent, uncle, aunt, brother or sister of the data subject and the giving of such consent is not prohibited by law,
( b ) the processing is necessary —
(i) for the performance of a contract to which the data subject is a party,
(ii) in order to take steps at the request of the data subject prior to entering into a contract,
(iii) for compliance with a legal obligation to which the data controller is subject other than an obligation imposed by contract, or
(iv) to prevent —
(I) injury or other damage to the health of the data subject, or
(II) serious loss of or damage to property of the data subject,
or otherwise to protect his or her vital interests where the seeking of the consent of the data subject or another person referred to in paragraph ( a ) of this subsection is likely to result in those interests being damaged,
( c ) the processing is necessary —
(i) for the administration of justice,
(ii) for the performance of a function conferred on a person by or under an enactment,
(iii) for the performance of a function of the Government or a Minister of the Government, or
(iv) for the performance of any other function of a public nature performed in the public interest by a person,
( d ) the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject.
(2) The Minister may, after consultation with the Commissioner, by regulations specify particular circumstances in which subsection (1)( d ) of this section is, or is not, to be taken as satisfied. ]
Inserted (1.07.2003) by Data Protection Amendment Act 2003 (6/2003), s. 4, S.I. No. 207 of 2003. Commenced (24.10.2007) in respect of manual data held in relevant filing systems on the passing of 6/2003 by s. 23(4), subject to transitional provision in subs. (5).
Power pursuant to subss. (1)(d) and (2) exercised (30.03.2016) by Data Protection Act 1988 (Section 2A) Regulations 2016 (S.I. No. 220 of 2016). Continued in force (25.05.2018) by Data Protection Act 2018 (7/2018), s. 68(1), S.I. No. 174 of 2018.
Power pursuant to subs. (1)(d) and (2) exercised (22.06.2013) by Data Protection Act 1988 (Section 2A) Regulations 2013 (S.I. No. 313 of 2013). Continued in force (25.05.2018) by Data Protection Act 2018 (7/2018), s. 68(1), S.I. No. 174 of 2018.
Previous affecting provision: section inserted (1.04.2002) by European Communities (Data Protection) Regulations 2001 (S.I. No. 626 of 2001), reg. 3; substituted as per F-note above.