SCHEDULES
SCHEDULE 1Special categories of personal data and criminal convictions etc data
PART 2Substantial public interest conditions
Racial and ethnic diversity at senior levels of organisations
9
1
This condition is met if the processing—
a
is of personal data revealing racial or ethnic origin,
b
is carried out as part of a process of identifying suitable individuals to hold senior positions in a particular organisation, a type of organisation or organisations generally,
c
is necessary for the purposes of promoting or maintaining diversity in the racial and ethnic origins of individuals who hold senior positions in the organisation or organisations, and
d
can reasonably be carried out without the consent of the data subject,
subject to the exception in sub-paragraph (3).
2
For the purposes of sub-paragraph (1)(d), processing can reasonably be carried out without the consent of the data subject only where—
a
the controller cannot reasonably be expected to obtain the consent of the data subject, and
b
the controller is not aware of the data subject withholding consent.
3
Processing does not meet the condition in sub-paragraph (1) if it is likely to cause substantial damage or substantial distress to an individual.
4
For the purposes of this paragraph, an individual holds a senior position in an organisation if the individual—
a
holds a position listed in sub-paragraph (5), or
b
does not hold such a position but is a senior manager of the organisation.
5
Those positions are—
a
a director, secretary or other similar officer of a body corporate;
b
a member of a limited liability partnership;
c
a partner in a partnership within the Partnership Act 1890, a limited partnership registered under the Limited Partnerships Act 1907 or an entity of a similar character formed under the law of a country or territory outside the United Kingdom.
6
In this paragraph, “senior manager”, in relation to an organisation, means a person who plays a significant role in—
a
the making of decisions about how the whole or a substantial part of the organisation's activities are to be managed or organised, or
b
the actual managing or organising of the whole or a substantial part of those activities.
7
The reference in sub-paragraph (2)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.