Lisa

Hi Mark, Thanks for your reply. Everyone must be busy reading hundreds of pages of legislation! We’re just finalising our procedures now. Good advice has been hard to find. Even the data privacy lawyers are reluctant. I have documented the phone call with the ICO so if we’re doing something wrong we can say they told us to (that was the compliance consultant’s advice). Thanks, Lisa

Hi All, I'm a new member so I hope I have posted this in the right place.... I spoke to the ICO a couple of times yesterday to clarify a few points regarding consent for sensitive personal data. During our discussion, the ICO lady referred to the Data Protection Act 2018 published on 24th May, specifically Schedule 1 - Part 2 -paragraph 20 (p139). This refers to processing of sensitive personal data for insurance purposes, with the lawful basis being "substantial public interest". https://ico.org.uk/for-organisations/data-protection-act-2018/ I have interpreted this as we don't need consent and don't need to record anything for collecting health info and criminal offence data (there's another "insurance Extension" in Schedule 1, Part 3 (p146) referring to criminal offence data). Please correct me if I'm wrong. I'd love to know what you think! Btw- the page numbers are the document page numbers, not the pdf page numbers. Lisa