Hi All,
I'm a new member so I hope I have posted this in the right place....
I spoke to the ICO a couple of times yesterday to clarify a few points regarding consent for sensitive personal data. During our discussion, the ICO lady referred to the Data Protection Act 2018 published on 24th May, specifically Schedule 1 - Part 2 -paragraph 20 (p139). This refers to processing of sensitive personal data for insurance purposes, with the lawful basis being "substantial public interest".
https://ico.org.uk/for-organisations/data-protection-act-2018/
I have interpreted this as we don't need consent and don't need to record anything for collecting health info and criminal offence data (there's another "insurance Extension" in Schedule 1, Part 3 (p146) referring to criminal offence data). Please correct me if I'm wrong. I'd love to know what you think!
Btw- the page numbers are the document page numbers, not the pdf page numbers.
Lisa