52. (1) Subject to subsection (2) and to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where it is necessary—

(a) for the purposes of preventative or occupational medicine,

(b) for the assessment of the working capacity of an employee,

(c) for medical diagnosis,

(d) for the provision of medical care, treatment or social care,

(e) for the management of health or social care systems and services, or

(f) pursuant to a contract with a health practitioner.

(2) Processing shall be lawful in accordance with subsection (1) where it is undertaken by or under the responsibility of—

(a) a health practitioner, or

(b) a person who in the circumstances owes a duty of confidentiality to the data subject that is equivalent to that which would exist if that person were a health practitioner.

(3) In this section, “health practitioner” has the same meaning as it has in the Health Identifiers Act 2014.