Conditions for consent

Data controllers must be able to show that the data subject's consent complies with the DPL where they are using consent as a basis for their processing activities.

Consent by a data subject must be:

• Freely given;
• Specific;
• Informed; and
• Unambiguous.

Where consent is given in a document that also concerns other matters then the consent must be:

• Clearly distinguishable;
• Intelligible and easily accessible; and
• Use clear, unambiguous and plain language.

Processing personal data

Data controllers may process personal data when any of the following conditions are met:

• The data subject has given his / her consent to the processing of that personal data;
• Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• Processing is necessary for compliance with an obligation to which the data controller is subject to by law;
• Processing is necessary in order to protect the vital interests of the data subject or another individual;
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of the QFC Authority, the QFC Regulatory Authority, QFC Civil and Commercial Court, the QFC Regulatory Tribunal or a QFC Institution;
• Processing is necessary for the purposes of the legitimate interests of the data controller or another person to whom the personal data is disclosed, except where such interests are overridden by legitimate interests of the data subject which require the data to be protected.

Processing sensitive personal data

Data controllers may process sensitive personal data when any of the following conditions are met:

• The data subject has given his / her explicit written consent to the processing;
• Processing is necessary for the purposes of carrying out the obligations and the exercise of specific rights of the data controller or the data processor in the field of employment law;
• Processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving his / her consent;
• Processing is carried out by an insurance firm for the purposes of providing a life or health insurance policy;
• Processing is carried out by a non-for-profit body in the course of its legitimate activities with appropriate guarantees that the processing relates solely to the members or former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data is not disclosed to a third party without the consent of the data;
• Processing relates to personal data which is manifestly made public by the data subject;
• Processing is necessary to establish, pursue or defend a legal claim or when a court is acting in its judicial capacity;
• Processing is necessary for compliance with an obligation to which the data controller is subject to by law;
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of the QFC Authority, the QFC Regulatory Authority, QFC Civil and Commercial Court, the QFC Regulatory Tribunal or a QFC Institution;
• Processing is necessary for substantial public interest reasons that are proportionate to the aim or aims pursued, respect the principles relating to the processing of personal data and provide suitable and specific measures to safeguard the rights of the data subject;
• Processing is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of healthcare services, and where that personal data is processed by a health professional subject under national laws or regulations established by national competent bodies to the obligation of professional secrecy or by another person also subject to an equivalent obligation of secrecy.