The Data Protection (Processing of Sensitive Personal Data) Order 2000

6.  The processing—

(a)is of sensitive personal data in relation to any particular data subject that are subject to processing which was already under way immediately before the coming into force of this Order;

(b)is necessary for the purpose of—

(i)carrying on insurance business, as defined in section 95 of the Insurance Companies Act 1982, falling within Classes I, III or IV of Schedule 1 to that Act; or

(ii)establishing or administering an occupational pension scheme as defined in section 1 of the Pension Schemes Act 1993; and

(c)either—

(i)is necessary in a case where the data controller cannot reasonably be expected to obtain the explicit consent of the data subject and that data subject has not informed the data controller that he does not so consent, or

(ii)must necessarily be carried out even without the explicit consent of the data subject so as not to prejudice those purposes.