Data Protection Act, 2011, sensitive personal information

Section 29 prohibits a data controller from processing personal information concerning a child who is subject to parental control, or a data subject's spiritual, religious or philosophical beliefs, race or ethnic origin, trade union membership, political affiliation, health, sexual life or criminal behaviour, unless the Act specifically permits it.

Biometric identifiers are separately defined in the Act as a technique of personal identification based on physical characteristics including fingerprinting, DNA analysis, retinal scanning and voice recognition, but they are not among the categories section 29 lists, so they carry no heightened restriction beyond the Act's general lawfulness, purpose limitation and security duties.

Sections 30 to 35 exempt specific processing of each listed category, including processing by a spiritual or religious organisation of its own members' beliefs, processing necessary to identify a data subject or comply with the law for race, processing by a trade union of its own members for the union's aims, processing by a political institution of its own members for the institution's aims, and processing by a medical professional, healthcare institution, insurer, school, or correctional or pension body for health or sexual life, each subject to a confidentiality obligation.

Personal information processed under the spiritual, religious, race, trade union or political exemptions may not be supplied to a third party without the data subject's consent.

Section 36 lifts the prohibition more generally where processing is carried out with prior parental consent for a child subject to parental control, where it is necessary to establish, exercise or defend a legal right, to comply with an obligation of international public law, where the Commission has authorised it in the public interest under section 37, where the data subject consents, or where the data subject has deliberately made the information public.

Section 37 lets the Commission authorise a data controller to process personal information where the public interest in the processing substantially outweighs the interference with the data subject's privacy, or where the processing carries a clear benefit to the data subject or a third party that substantially outweighs that interference, subject to any conditions the Commission imposes.