PERSONAL DATA PROTECTION
67
FOURTH SCHEDULE—continued
- (iv) a requirement to remove or destroy individual identifiers at the earliest reasonable opportunity; and
- (v) a requirement not to use the personal data for any other purpose or to disclose the personal data in individually identifiable form without the express authorisation of the organisation that disclosed the personal data.
5. For the avoidance of doubt, personal data collected before the appointed day in the circumstances and conditions set out in the Second Schedule shall satisfy paragraph 1(s) notwithstanding that section 17(1) was not in force at the time of the collection.
FIFTH SCHEDULE
Section 21(2)
EXCEPTIONS FROM ACCESS REQUIREMENT
1. An organisation is not required to provide information under section 21(1) in respect of—
- (a) opinion data kept solely for an evaluative purpose;
- (b) any examination conducted by an education institution, examination scripts and, prior to the release of examination results, examination results;
- (c) the personal data of the beneficiaries of a private trust kept solely for the purpose of administering the trust;
- (d) personal data kept by an arbitral institution or a mediation centre solely for the purposes of arbitration or mediation proceedings administered by the arbitral institution or mediation centre;
- (e) a document related to a prosecution if all proceedings related to the prosecution have not been completed;
- (f) personal data which is subject to legal privilege;
- (g) personal data which, if disclosed, would reveal confidential commercial information that could, in the opinion of a reasonable person, harm the competitive position of the organisation;
- (h) personal data collected, used or disclosed without consent, under paragraph 1(e) of the Second Schedule, paragraph 1(e) of the Third Schedule or paragraph 1(f) of the Fourth Schedule, respectively, for the purposes of an investigation if the investigation and associated proceedings and appeals have not been completed;
