Judgment Approved by the court for handing down.
R (Bridges) -v- CC South Wales & ors
This condition is met if the processing(a) is necessary for the purpose of, or in connection with, any
legal
proceedings
(including
prospective
legal
proceedings)…”
28.
Section 42 contains requirements in respect of the “appropriate policy document”
referred to in section 35(4), that must be in place:
“42 Safeguards: sensitive processing
(1) This section applies for the purposes of section 35(4) and (5)
(which require a controller to have an appropriate policy
document in place when carrying out sensitive processing in
reliance on… a condition specified in Schedule 8).
(2) The controller has an appropriate policy document in place
in relation to the sensitive processing if the controller has
produced a document which—
(a) explains the controller's procedures for securing
compliance with the data protection principles (see section
34(1)) in connection with sensitive processing in reliance on
the consent of the data subject or (as the case may be) in
reliance on the condition in question, and
(b) explains the controller's policies as regards the retention
and erasure of personal data processed in reliance on the
consent of the data subject or (as the case may be) in reliance
on the condition in question, giving an indication of how long
such personal data is likely to be retained.
(3) Where personal data is processed on the basis that an
appropriate policy document is in place, the controller must
during the relevant period—
(a) retain the appropriate policy document,
(b) review and (if appropriate) update it from time to time, and
(c) make it available to the Commissioner, on request, without
charge.
(4) The record maintained by the controller under section 61(1)
and, where the sensitive processing is carried out by a processor
on behalf of the controller, the record maintained by the
processor under section 61(3) must include the following
information—
(a) …which condition in Schedule 8 is relied on,