Page 213 - Demo
P. 213
the name appeared in a list of donors, for example, it would not be personal information, but if in a list of members of your institute (such as an internal address book), it might, if you would be able to identify the individual John Smith through other information publicly available, such as from the phone book, where you could search by name and location.
Sensitive personal data is a further sub-set of personal information, over which there is special protection. This is known as a “special category” of personal information under GDPR, and includes (amongst other categories):
The racial or ethnic origin of the individual
The individual’s political opinions
The religious beliefs or other beliefs of a similar nature of the individual
Whether the individual is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992)
Information relating to the health of the individual
Their sexual life – including sexual orientation
The Commission, or alleged commission, by the individual of any offence, or any proceedings for any offence committed or alleged to have been committed by them, the disposal of such proceedings or the sentence of any court in such proceedings
The fact that an individual’s religious beliefs are sensitive personal information
is particularly important, because association with a religious institute can, effectively, disclose the religious beliefs of an individual. What this means in practice is that you need to make sure that you have explicit consent from individuals to any public association with the institute – otherwise you are potentially in breach of the rst data protection principle, because you will not be able to meet a condition in Schedule 3 of the DPA (to become Article 9 GDPR). Those individuals who are members of the institute will, by entering into their vows, have expressed a public declaration of their association with the institute. However, members of staff who work for your institute would not be treated
as having made such a public declaration and you should therefore be careful
of doing anything to suggest what their particular religious beliefs may be. This is true unless they have given their consent, the information is already public because of actions taken by that individual, or you are only using the information within the institute and not disclosing or making public yourselves.
Chapter 11 209
