51. (1) Processing of special categories of personal data shall be lawful where the processing is carried out in accordance with regulations made under subsection (3).

(2) Article 10 data may be processed where the processing is carried out in accordance with regulations made under subsection (3).

(3) Regulations may be made authorising the processing, where necessary for reasons of substantial public interest, of either or both of the following—

(a) special categories of personal data, and

(b) without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016, Article 10 data.

(4) Without prejudice to the generality of subsection (3), regulations made under that subsection shall identify—

(a) the substantial public interest concerned, and

(b) the suitable and specific measures to be taken to safeguard the fundamental rights and freedoms of data subjects in processing the personal data which is authorised by the regulations.

(5) For the purposes of subsection (4)(b), subsections (2) to (8) of section 36 shall apply in like manner to regulations made under subsection (3) as they apply to regulations made under section 36.

(6) Regulations may be made under subsection (3) by—

(a) the Minister, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, or

(b) any other Minister of the Government following consultation with the Minister, such other Minister of the Government as he or she considers appropriate and the Commission.

(7) The Minister or any other Minister of the Government, as the case may be, making regulations under subsection (3) shall have regard to the need for the protection of individuals with regard to the processing of their personal data, and without prejudice to the generality of that need, have regard to—

(a) the nature, scope and purposes of the processing,

(b) the nature of the substantial public interest concerned,

(c) any benefits likely to arise for the data subjects concerned,

(d) any risks arising for the rights and freedoms of such subjects, and

(e) the likelihood of any such risks arising and the severity of such risks.

(8) Regulations made under subsection (3) shall—

(a) respect the essence of the right to data protection, and

(b) enable processing of such data only in so far as is necessary and proportionate to the aim sought to be achieved.

(9) In this section, “Article 10 data” has the meaning assigned to it by section 55.