Further conditions for processing sensitive data for a law enforcement purpose are detailed in Schedule 8 of the Data Protection Act 2018. The most relevant to NHSCFA are:
The processing is necessary for the exercise of a function conferred on a person by an enactment…and is necessary for reasons of substantial public interest.
The processing is necessary for:
- the purpose of, or in connection with, any legal proceedings, including prospective legal proceedings,
- the purpose of obtaining legal advice; or
- is otherwise necessary for the purposes of establishing, exercising or defending legal rights
The processing (including disclosure) is necessary for the purposes of preventing fraud or a particular kind of fraud, and
- the NHSCFA is acting as a competent authority as a member of an anti-fraud organisation, or
- in accordance with arrangements made by such an organisation.
The processing is necessary for
- statistical purposes