Further conditions for processing sensitive data for a law enforcement purpose are detailed in Schedule 8 of the Data Protection Act 2018. The most relevant to NHSCFA are:
Statutory purpose
The processing is necessary for the exercise of a function conferred on a person by an enactment…and is necessary for reasons of substantial public interest.
Legal claims
The processing is necessary for:
- the purpose of, or in connection with, any legal proceedings, including prospective legal proceedings,
- the purpose of obtaining legal advice; or
- is otherwise necessary for the purposes of establishing, exercising or defending legal rights
Preventing fraud
The processing (including disclosure) is necessary for the purposes of preventing fraud or a particular kind of fraud, and
- NHSCFA is acting in accordance with arrangements made by an anti-fraud organisation.
Archiving
The processing is necessary for
- statistical purposes