What are the substantial public interest conditions?

In detail:

• What substantial public interest conditions are available?
• How do the substantial public interest conditions work?
• What are ‘reasons of substantial public interest’?
• What is the role of consent?
• What is an appropriate policy document?

What substantial public interest conditions are available?

The 23 conditions are set out in paragraphs 6 to 28 of Schedule 1 of the DPA 2018:

6. Statutory and government purposes
7. Administration of justice and parliamentary purposes
8. Equality of opportunity or treatment
9. Racial and ethnic diversity at senior levels
10. Preventing or detecting unlawful acts
11. Protecting the public
12. Regulatory requirements
13. Journalism, academia, art and literature
14. Preventing fraud
15. Suspicion of terrorist financing or money laundering
16. Support for individuals with a particular disability or medical condition
17. Counselling
18. Safeguarding of children and individuals at risk
19. Safeguarding of economic well-being of certain individuals
20. Insurance
21. Occupational pensions
22. Political parties
23. Elected representatives responding to requests
24. Disclosure to elected representatives
25. Informing elected representatives about prisoners
26. Publication of legal judgments
27. Anti-doping in sport
28. Standards of behaviour in sport

You should identify which of these conditions appears to most closely reflect your purpose. This guidance gives you some general advice on how the conditions generally work, but you always need to refer to the detailed provisions of each condition in the legislation itself to make sure you can demonstrate it applies.

How do the substantial public interest conditions work?

The substantial public interest conditions give you the basis in UK law for relying on Article 9(2)(g).

These conditions allow you to process special category data for a variety of specific purposes. If you are clear on your purpose for processing, it should be relatively straightforward to identify the most relevant condition(s). You then need to consider the detail of that condition carefully, and ensure you can demonstrate that it applies. The conditions are narrowly drawn and generally require you to meet a number of specific criteria.

For some of these conditions, the substantial public interest element is built in. For others, you need to be able to demonstrate that your specific processing is “necessary for reasons of substantial public interest”, on a case-by-case basis.

For some of the conditions, you also need to justify why you cannot give individuals a choice and get explicit consent for your processing.

In most cases, you must have an ‘appropriate policy document’ in place.

*Under conditions 10 and 27, you don’t need an appropriate policy document to disclose data to the relevant authorities (or prepare to disclose it). You still need an appropriate policy document for other processing activities.

What are ‘reasons of substantial public interest’?

The term ‘substantial public interest’ is not defined in the DPA 2018 or the UK GDPR.

Some of the conditions assume that processing under that condition is always in the substantial public interest, eg ensuring equality, or preventing fraud. However, some only apply to the extent that the processing is “necessary for reasons of substantial public interest”.

The public interest covers a wide range of values and principles relating to the public good, or what is in the best interests of society. Commercial or private interests are not the same as a public interest, and if you need to point to reasons of substantial public interest it is not enough to point to your own interests. Of course, you can still have a private interest - you just need to make sure that you can also point to a wider public benefit.

Substantial public interest means the public interest needs to be real and of substance. Given the inherent risks of special category data, it is not enough to make a vague or generic public interest argument – you should be able to make specific arguments about the concrete wider benefits of your processing. For example, you may wish to consider how your processing benefits the public in terms of both depth (ie the amount of benefit experienced from the processing, even if by a small number of people) and breadth (the volume of people benefiting from the processing).

You should focus on showing that your overall purpose for processing has substantial public interest benefits. You do not need to make separate public interest arguments or show specific benefits each time you undertake that processing, or for each separate item of special category data, as long as your overall purpose for processing special category data is of substantial public interest. However, you must always be able to demonstrate that all your processing under the relevant condition is actually necessary for that purpose and complies with the data minimisation principle.

What is the role of consent?

Many of the substantial public interest conditions only apply if there is a good reason why you cannot get valid explicit consent.

As a general rule, for these conditions you should consider first whether you could give individuals a choice and only process their special category data with their explicit consent. However, there may be a good reason why you should not give individuals an upfront choice. For example, you might not want to ask for consent if you were investigating someone and tipping them off might prejudice your investigation. Alternatively, you may be able to show that you cannot technically get valid consent in the circumstances, but there is a good reason to go ahead anyway. For example, public authorities, employers and other organisations in a position of power may not be able to demonstrate that consent would be freely given.

The details of the conditions vary, so if you do have a reason for not getting explicit consent, or you think it wouldn’t be valid, you must always check the detail of the relevant condition to see exactly what justification you need.

What is an appropriate policy document?

An appropriate policy document is a short document outlining your compliance measures and retention policies for special category data. The DPA 2018 says you must have one in place for almost all of the substantial public interest conditions (and also for the employment, social security and social protection condition), as a specific accountability and documentation measure.

It doesn’t have to take any particular form, as long as it briefly outlines:

• the Schedule 1 condition (or conditions) you are relying on;
• your procedures for complying with each of the principles;
• your retention and deletion policies; and
• an indication of the retention period for the specific data.

If you process special category data for a number of different purposes you don’t need a separate policy document for each condition or processing activity – one document can cover them all. You should provide the data subject with sufficient information to understand how you are processing their special category data and how long you will retain it for.

We have developed an appropriate policy document template to help you meet this requirement.

If you have carried out a DPIA, you should be able to reuse Part 4 of your DPIA (necessity and proportionality) to inform your appropriate policy document.

You need to retain your appropriate policy document until six months after the date you stop the relevant processing. You must keep it under review. You do not have to publish it, although it is good practice to do so. If we ask to see it, you must provide it to us free of charge.

You also need to include some further details in your general UK GDPR documentation:

• how the processing satisfies a lawful basis;
• your condition for processing special category data; and
• whether you have followed your retention and deletion policies - and if not, why not.