The Data Protection (Processing of Sensitive Personal Data) Order 2000

7.—(1) Subject to the provisions of sub-paragraph (2), the processing—

(a)is of sensitive personal data consisting of information falling within section 2(c) or (e) of the Act;

(b)is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons—

(i)holding different beliefs as described in section 2(c) of the Act, or

(ii)of different states of physical or mental health or different physical or mental conditions as described in section 2(e) of the Act,

with a view to enabling such equality to be promoted or maintained;

(c)does not support measures or decisions with respect to any particular data subject otherwise than with the explicit consent of that data subject; and

(d)does not cause, nor is likely to cause, substantial damage or substantial distress to the data subject or any other person.

(2) Where any individual has given notice in writing to any data controller who is processing personal data under the provisions of sub-paragraph (1) requiring that data controller to cease processing personal data in respect of which that individual is the data subject at the end of such period as is reasonable in the circumstances, that data controller must have ceased processing those personal data at the end of that period.