Code of Ethics and Guidelines (The UK)




1. Autonomous practice

As registered health professionals Members are expected to practise

autonomously and, if they are the subject of fitness to practise proceedings

brought by the Health Professions Council (“HPC”), will be held accountable on

that basis.

Generally, Members are not accountable for the clinical decisions of other health

professionals but do have an obligation to take appropriate action if another

health professional deviates from accepted standards of professional practice.

That obligation will apply not only in relation to other Members but also where

Members are working in a multidisciplinary setting, and whether or not they have

any formal authority over practitioners from other disciplines.

Autonomy is not infinite. Clinical autonomy is exercised within the policies and

priority constraints set by a manager or other policy setter. Practice autonomy

operates within the resource and policy constraints of a manager, the

management team or health authority.

Clinical autonomy for Members is the freedom to exercise discretion in art

therapy casework with individual clients, within available resources and other

limits, and without that discretion being overridden by a higher authority unless

negligence or some other improper act is suspected.

Practice autonomy is the freedom to exercise discretion in the immediate

management and running of a practice, department or specialty, within defined

limits and available resources and without that discretion being overridden by a

higher authority unless negligence or some other improper act is suspected.

Where conflicts of interest arise between the therapeutic role and other roles,

Members should seek to ensure that the integrity of the therapeutic role is

maintained within the available resources and any other limitations.

2. Consent

Members should ensure that a client’s consent to treatment is informed consent.

Obtaining a client’s signature on a consent form is not necessarily evidence of

informed consent if the client has been pressed into signing the form on the basis

of limited information.

Where a client is physically unable to sign a consent form that is not a bar to


treatment if the client is capable of and has given consent orally. In such

circumstances Members must ensure that they properly record how consent was


Consent is a continuing process and Members must remember that a client may

withdraw consent at any time. Members should keep completed consent form

with the client’s notes and any changes made to a form should be initialled and

dated by both the client and the Member.

Members can only obtain consent for care that they are capable of providing. A

Member who acts outside of their scope of practice will not be protected because

they have the purported consent of the client. If a Member believes that a task is

beyond their own scope of practice then they must refer the client to an

appropriately qualified practitioner. In accepting referrals from other health or

social-care professionals, a Member must ensure that they fully understand the

nature of the referral and that it is within their scope of practice.

Consent and the Mental Health Act

The Mental Health Act 1983 provides for certain treatment, such as electroconvulsive

therapy, to be carried out with a client’s consent where:

(a) a registered medical practitioner (not being the responsible clinician (if

there is one) or the person in charge of the treatment in question) and two other

persons (not being registered medical practitioners) have certified in writing that

the patient is capable of understanding the nature, purpose and likely effects of

the treatment in question and has consented to it; and

(b) the registered medical practitioner referred to in paragraph (a) above has

certified in writing that it is appropriate for the treatment to be given.

Before giving such a certificate, the registered medical practitioner shall consult

two other persons who have been professionally concerned with the patient’s

medical treatment but, of those persons:

(a) one shall be a nurse and the other shall be neither a nurse nor a registered

medical practitioner; and

(b) neither shall be the responsible clinician (if there is one) or the person in

charge of the treatment in question.

Where Members are asked to provide second opinions for the purposes of the

Mental Health Act, they must ensure that they are not pressurised into doing so

because of the limited number of appropriately qualified health professionals

available, but act on their own judgement and within the limits of their knowledge,

skills and experience.

Consent when clients lack capacity

An apparent lack of capacity to give or withhold consent may in fact be the result

of communication difficulties rather than genuine incapacity. Members should


seek to involve appropriately qualified colleagues in making assessments of

incapacity and, if at all possible, the client should be assisted to make and

communicate their decision, for example by providing information in non-verbal

ways where appropriate.

Where an adult client does not have the capacity to give or withhold consent this

fact should be recorded in the client’s notes together with an assessment of the

client’s capacity, why the Member believes that art therapy is in the client’s best

interests and the involvement of those close to the client who have given


Consent when working with children

If a child (i.e. someone under 18) is not competent to give consent, Members

should seek consent from a person who has ‘parental responsibility for that child

according to the Children Act 1989 (the “Children Act”). Although only one

person with parental responsibility needs to consent, it is good practice to involve

all those who are responsible for the child in the decision-making process.

The Children Act defines “parental responsibility” as all the rights, duties, powers,

responsibilities and authority which by law a parent of a child has in relation to

the child and his property. It will often but not always be a child's natural parents

that give consent but those with parental responsibility include:

each of the child’s parents, if they were married to each other at the time

of their child’s conception or birth;

Where a child's father and mother were not married to each other at the

time of his birth —

(a) the mother shall have parental responsibility for the child;

(b) the father shall have parental responsibility for the child if he has

acquired it (and has not ceased to have it) in accordance with the

provisions of the Children Act;

the child's legally appointed guardian;

a special guardian appointed by court order;

a person in whose favour a court has made a residence order concerning

the child;

a local authority designated in a care order in respect of the child (but not

where the child is being looked after under section 20 of the Children Act,

also known as being ‘accommodated’ or in ‘voluntary care’; and

A local authority or other authorised person who holds an emergency

protection order in respect of the child.

Foster parents, stepparents and grandparents do not automatically have parental



Members must also take into account the following provisions under the Children


References in this Act to a child whose father and mother were, or (as the

case may be) were not, married to each other at the time of his birth must

be read with section 1 of the Family Law Reform Act 1987 (which extends

their meaning).

The rule of law that a father is the natural guardian of his legitimate child is


More than one person may have parental responsibility for the same child

at the same time;

A person who has parental responsibility for a child at any time shall not

cease to have that responsibility solely because some other person

subsequently acquires parental responsibility for the child;

Where more than one person has parental responsibility for a child, each

of them may act alone and without the other (or others) in meeting that

responsibility, unless any legislative enactment requires the consent of

more than one person in a matter affecting the child;

The fact that a person has parental responsibility for a child shall not

entitle him to act in any way that would be incompatible with any order

made with respect to the child under the Children Act;

A person who has parental responsibility for a child may not surrender or

transfer any part of that responsibility to another but may arrange for some

or all of it to be met by one or more persons acting on his behalf;

The person with whom any such arrangement is made may himself be a

person who already has parental responsibility for the child concerned;

The making of any such arrangement shall not affect any liability of the

person making it, which may arise from any failure to meet any part of his

parental responsibility for the child concerned;

A person who does not have parental responsibility for a particular child

but has care of the child may (subject to the provisions of Children Act) do

what is reasonable in all the circumstances of the case for the purpose of

safeguarding or promoting the child's welfare.

If children are competent to give consent for themselves, Members should seek

consent directly from them. Even if a child is not competent to take a particular


decision, the child should still be involved as much as possible.

It is for Members to judge whether a child is competent to give consent and the

test (so- called ‘Gillick competence’, from the decision in

Gillick v West Norfolk

and Wisbech Area Health Authority

) is, in essence, whether the child has

sufficient understanding and intelligence to be able to understand fully what is

proposed, that being a question of fact in each case.

If a Member decides that a child is competent to give consent then parental

consent to treatment is not required and the Member must respect any request

from the child not to disclose details of treatment to those with parental

responsibility for that child.

Even if a child is competent to give consent, it is still good practice to encourage

competent children to involve their families in the decision-making process.

Children with Disabilities

Members should not assume that a child with learning disabilities is not

competent to give consent. Many children will be competent to do so if

information is presented in an appropriate way and they are supported through

the decision-making process.

Where a child has a disability, Members should take particular care to ensure

that information is provided in a suitable form involving, for example, interpreters

for hearing impaired children or appropriate materials for those with learning

disabilities. Specialist colleagues may be able to act as facilitators where children

have particular needs.

Consent when Working with Older People

Seeking consent is part of a respectful relationship with an older person.

Members should never assume that older people cannot take any decisions for

themselves, just because they have been unable to take a particular decision in

the past.

Some older people may have capacity to consent to some interventions but not

to others. People suffering from the early stages of dementia, for example, may

have capacity to make straightforward decisions about their own care, but might

lack capacity to take complex decisions.

Older people may also be able to make a particular decision one day even if they

were not able to take it the day before. Where the client’s capacity is fluctuating

Members should, if possible and appropriate, delay treatment decisions until a

point when the client has the capacity to make their own decision.

People close to the client may sometimes be able to assist in choosing an

appropriate time to discuss the client’s healthcare wishes. It is important that any


person helping to 'translate’ an older person’s wishes realises that it is the older

person’s views and wishes that are important, not what they think is best for the

older person.

Members may find it helpful, in assessing an older person’s comprehension and

ability to make choices, to explore:

the client’s ability to paraphrase what has been said (repeating and

rewording explanations as necessary);

whether the client applies information they have been given to their own

case; and

whether the client is able to compare alternatives, or to express any

thoughts on possible consequences other than those which you have


Consent when working with People in Prisons

Prisoners have the same rights as others to withhold consent to treatment and it

is important to ensure that a prisoner’s decision is truly their own. Members must

not participate in attempts to coerce a person in prison to provide consent, for

example, by implying that a decision to give or withhold consent could affect their

privileges or remission of sentence.

Where a prisoner has a serious mental disorder that warrants detention and care

under the Mental Health Act 1983, Members are reminded that the powers

provided by the Act can only be used where a prisoner is detained in hospital.

Prison health care centres are not hospitals for this purpose and treatment can

therefore only be provided after the prisoner has been transferred to an

appropriate hospital.

Recorded images

Photographic, video and other images recorded for clinical purposes form part of

a client’s health record and must not be used for any other purpose without


Members should always ensure that they make clear, at the start of any therapy,

whether photographic or video recordings will result from therapy and seek

permission for the inclusion of such images in the client’s notes.

Members who wish to use such recordings for education, publication or research

purposes must seek the client’s written consent, ensuring that the client (or any

other person giving consent on the client’s behalf as outlined in this section) is

fully aware of the possible uses of the material and, in particular, that the

member may not be able to control future use of the material once it has been


placed in the public domain.

Members who wish to make recording specifically for education, publication or

research purposes must obtain both the client’s consent to make the recording

and to use it. Where a client consents to a recording being made for this

purpose they must be told that they are free to stop the recording at any time and

that they are entitled to view it if they wish, before deciding whether to give

consent to its use. If the client does not consent to the recording being used, it

must be destroyed. As with recordings made with therapeutic intent, Members

must inform clients about the possible future use of the recording, including the

fact that it may not be possible to control future use of the material once it is in

the public domain.

3. Confidentiality

Clients have a right to expect that information about them which they entrust to

Members will be held in confidence and not shared with other people without the

client’s consent. In addition to obligations under the Data Protection Act 1998

(“DPA”), the duty of confidentiality derives from the common law and is based

upon the mutual obligations created when one person discloses information to

another in circumstances where it is reasonable to expect that the information will

be held in confidence.

The obligation to respect client confidentiality is an essential part of health care

practice and helps to ensure that clients provide all of the information they need

in order to provide effective care.

Whilst clients’ rights to privacy are important they are not absolute and situations

may arise in which a Member is faced with conflicting legal duties and may have

to act in a way which would otherwise be a breach of their duty of confidentiality.

Members may disclose information without the client’s consent where it is in the

public interest to do so, for example, where failure to do so may expose the

patient or others to risk of death or serious harm, where a disclosure may assist

in the prevention, detection or prosecution of a serious crime, or where

disclosure is necessary to protect a child or vulnerable person from being


Compelled disclosure

Client information may properly be disclosed where a Member is compelled to do

so in response to a demand made by a court or by other authorities, such as the

HPC, exercising specific statutory powers. Other than in exceptional

circumstances, for example in relation to the prevention of terrorism, the police

do not have the power to compel disclosure of confidential health records.


If Members have any doubt about whether disclosure is a statutory obligation,

they should ask the person or body seeking the information to specify, preferably

in writing, the legislation under which the information is sought.

The courts and certain tribunals have the power to require the disclosure of

information that may be relevant to matters within their jurisdiction. Where a

court or tribunal so orders and the client has not given consent for the disclosure

Members must make the disclosure strictly within the terms of the order. For

example, if the order requires disclosure to the court, then the information should

be handed to the court only.

Members may experience a conflict of duties if a court demands the disclosure of

information which the Member feels, on ethical grounds, should not be disclosed.

In such cases Members should make their ethical objections known to the judge

or presiding officer but, if the court nonetheless decides that the information must

be released, Members risk being found in contempt of court or, in the case of

certain tribunal proceedings of committing an offence, if they refuse to comply.

Disclosure in criminal cases

If a Member refuses to release health records for use in criminal proceedings the

person seeking the information may apply to the court for a witness summons to

be issued requiring the Member to produce the information. The court rules

place the burden on the person seeking disclosure to justify the issuing of a

witness summons, requiring them to state specifically what information they

require, why they believe the Member concerned holds the information and why it

is material to the case. Before issuing a summons the court will allow the

Member an opportunity to make representations as to why the information should

not be disclosed. If a summons is issued the information must be provided or the

Member risks being found in contempt of court.

Search and seizure

Health records are ‘excluded material’ for the purposes of the Police and Criminal

Evidence Act 1984 and therefore cannot be the subject of an ordinary search

warrant issued by a Magistrate. If the police wish to search for and seize

excluded material they must seek an order for its production or a special warrant

to search for and seize it from a circuit judge.

Court reports

Members who are asked to prepare reports for use in court proceedings need to

ensure that they:

have any consent necessary to do so; and

clearly understand whether they are being asked to provide factual


evidence or expert opinion.

There is a crucial distinction between providing what amounts to a witness

statement – a report describing facts directly observed by the member - and

attempting to offer a professional opinion or recommendation to the court.

Members should only act as expert witnesses where they are competent to do

so. Members should only provide expert opinion evidence on matters within their

scope of practice and should ensure that they understand relevant court

procedures and the obligations imposed on expert witnesses, including the

overriding duty which they owe to the court, before agreeing to act as an expert.

Members who fail to do so may find their expertise seriously challenged in court.

Members, in preparing court reports, need to recognise that they may become

involved in progressively greater levels of disclosure as the case proceeds and,

on the basis of their report, required to grant access to the original notes, therapy

records, artwork and images. Members should take account of the risks

associated with such disclosure and discuss them with the client.

Retention of artwork

If artwork is retained by Members whilst a client is undergoing therapy it will in

most cases form part of the client’s health records and therefore should be

subject to the same sort of security arrangements as other confidential client

information. Members should ensure that, so far as possible, such artwork is

kept in locked storage in an individual folder clearly marked with the clients’

name or initials, the Member’s name, and the dates of therapy. These

arrangements need to be continued even after therapy ends.

If, once therapy ends, the client is given the option of taking their artwork and

does so, it will cease to be part of the client’s health records.

4. Clients Records

Health records are a specifically defined category of data to which the DPA

applies. The DPA defines a health record as a record consisting of information

about the physical or mental health or condition of an identifiable individual made

by or on behalf of a registered health professional in connection with the care

that individual.

Such records include any information or material made by or on behalf of a

Member in connection with the care of a client. Members must ensure that they

comply with their obligations under the DPA including the data protection

principles that personal data must be lawfully processed, accurate, not

excessive, retained for no longer than necessary, and kept under secure

conditions (see Appendices C-E to these guidelines).


Clients have a right of access to their health records under the DPA but, except

where Members are independent practitioners, those records will ultimately be

the responsibility of their employing hospital or NHS Trust. A client who wishes

to gain access to their records should therefore be advised to apply to that body,

using the established DPA procedures. Clients can be denied access to all or

part of their records where a clinician is able to show that allowing access may

be damaging to the patient.

Members should comply with their employer’s policies and procedures for the

recording, storage, disposal and destruction of clinical records and other

confidential material. For example, many organisations have adopted the

practice of prohibiting clinicians from storing client information on the hard drive

of computers, but requiring it to be recorded on a floppy disc or other portable

media and stored in a locked place with the client’s paper records. This

procedure should be followed by Members where it is in place.

Clients records in private practice

Members working in private practice are responsible for their own DPA

registration and compliance, and for how their records are kept and stored.

Members in private practice who are sole practitioners should give consideration

to what will happen to their records after their death and are recommended to

make appropriate provision in their will for the storage or destruction of those


Manual records

Records should contain a ‘top sheet’, which sets out key information including the

client’s name, address, telephone number and date of birth; their gender, religion

and ethnic origin and the names and contact details for their general practitioner

and other key professionals and contacts.

Clinical notes should contain a description of the noteworthy aspects of the

session in a style that is more objective than subjective, for example, a brief

account of what took place and what was said written in a clear and

unambiguous style which avoids judgmental comments. This may be followed by

a brief indication of any speculative comments or opinions as long as they are

identified as such.

Certain factual information should be regularly recorded including:

the client’s attendance and non attendance;

details of any relevant interventions such as telephone calls, case reviews

and other inter-professional correspondence or discussions;


notes of any telephone calls with the client, their family, carers or other

health professionals, including the date and time of each call, the content

of the conversation and any advice given or action taken;

any action taken in relation to suicidal or homicidal intents or ideas

communicated by the client; and

any difficulties arising during therapy between the Member and the client,

including any threats made by the client or any dispute arising from the

termination of therapy.

When making handwritten records Members should:

use black ink;

ensure there are no gaps in the notes and if accidental gaps occur, cross

them through;

include details of any unwritten consent to therapy provide by the client or

any other person on their behalf;

sign all entries, showing their title and profession, the date and time of

each entry and countersign any notes written by students;

clearly record all clinical judgments as such, for example “In my opinion…”

or “In my view...” but not record judgmental opinions;

if using loose-leaf pages ensure that the client’s name and identification

number are shown on each page, and any gaps are crossed through;

not use abbreviations unless they are widely understood;

If an entry has been made in the wrong case notes, strike it through with a

single diagonal line and endorse the entry to show that it was wrongly


not use correction fluid or totally obliterate anything that has been written,

but initial and cross out errors with a single line so that what has been

written first remains legible; and

clearly indicate if notes have not been written contemporaneously, for

example “yesterday I saw...” or “I forgot to write on [date]....” or, if adding

to case notes by showing the date on which the addition was made.


Appendix A

Specifications for a Purpose Built Art Therapy Department

The following is appropriate for a department with two full time staff or three part

time staff providing a service to an acute mental health unit, containing 65-70


As the pottery and art room will be used for one-to-one sessions, group work and

open studio sessions, confidentiality needs must be considered and

soundproofing incorporated where necessary.


15 sq. metres with desk space for three people;

storage for paperwork and storage of confidential files etc;

storage space for photocopy paper, and other stationary items;

shelving for books, box files, policy folders, telephone directories

equipment catalogues etc;

computer and printer; and

notice boards.

Pottery room

40 sq. metres with good lighting;

large shallow sink;

kiln and extractor fan;

pugmill to reclaim clay and prevent clay wastage;

tables and chairs;

potter’s wheel, kickwheel or electric;

storage for moulds;

clay bins;

shelving for clay, glazes etc; and

shelves for safe storage of people’s work.

Art room

40 sq. metres with good lighting;

floor with non-slip surface. no carpet except in social area;

tables and chairs;

shelving for paper, card, paints and other materials;

shelving for books;

cupboard – metal and lockable for storage of materials, including white

spirit and methylated spirit;



shelving for cups, tea, coffee etc;


easy chairs for small social area to enable time out from art making; and

plan chests for safe storage of people’s artwork.


Appendix B

Consent to student’s use of client information

1 Student Placement Consent Letter

Dear …………..

I am a student in Art Psychotherapy at the University of ... and part of my

placement experience is at...

In order to finish the course I have to complete certain pieces of written work.

One of these is a case study, which involves writing about the background of the

clients and about the Art Psychotherapy sessions. This includes taking

photographs of any work the client makes.

I would be grateful if you would sign and give your permission for me to refer to

case notes, record sessions, take photographs and write a case study.

If you have any questions about this please do not hesitate to contact me ..........

and my placement supervisor................. at ..........................on......................

I enclose a consent form for you to sign.

Yours sincerely

Art Psychotherapy Trainee

2. Response letter from client

I give permission for student write a case study of my art

therapy sessions.

I have read the accompanying letter and I understand its content.

Name: _________________________________________________

Signature: ______________________________________________

Date: ____________________________


Appendix C

The following are principles under the Data Protection Act 1998 (“DPA”), which

may alter from time to time, depending on amendment to the Act:

1) Personal data shall be processed fairly and lawfully and, in particular, shall

not be processed unless:

(a) at least one of the conditions in Appendix D is met, and

(b) in the case of sensitive personal data, at least one of the conditions in

Appendix E is also met.

2) Personal data shall be obtained only for one or more specified and lawful

purposes, and shall not be further processed in any manner incompatible

with that purpose or those purposes.

3) Personal data shall be adequate, relevant and not excessive in relation to

the purpose or purposes for which they are processed.

4) Personal data shall be accurate and, where necessary, kept up to date.

5) Personal data processed for any purpose or purposes shall not be kept for

longer than is necessary for that purpose or those purposes.

6) Personal data shall be processed in accordance with the rights of data

subjects under the DPA.

7) Appropriate technical and organisational measures shall be taken against

unauthorised or unlawful processing of personal data and against

accidental loss or destruction of, or damage to, personal data.

8) Personal data shall not be transferred to a country or territory outside the

European Economic Area unless that country or territory ensures an

adequate level of protection for the rights and freedoms of data subjects in

relation to the processing of personal data.


Appendix D

Conditions Relevant for Purposes of the First Principle: Processing of any

Personal Data

1 The data subject has given his consent to the processing.

2 The processing is necessary:

(a) for the performance of a contract to which the data subject is a party, or

(b) for the taking of steps at the request of the data subject with a view to

entering into a contract.

3 The processing is necessary for compliance with any legal obligation to

which the data controller is subject, other than an obligation imposed by


4 The processing is necessary in order to protect the vital interests of the data


5 The processing is necessary:

(a) for the administration of justice,

(aa) for the exercise of any functions of either House of Parliament,

(b) for the exercise of any functions conferred on any person by or under

any legislative enactment,

(c) for the exercise of any functions of the Crown, a Minister of the Crown

or a government department, or

(d) for the exercise of any other functions of a public nature exercised in

the public interest by any person.

6 (1) The processing is necessary for the purposes of legitimate interests

pursued by the data controller or by the third party or parties to whom the

data are disclosed, except where the processing is unwarranted in any

particular case by reason of prejudice to the rights and freedoms or

legitimate interests of the data subject.

(2) The Secretary of State may by order specify particular circumstances

in which this condition is, or is not, to be taken to be satisfied.


Appendix E

Conditions Relevant for Purposes of the First Principle: Processing of

Sensitive Personal Data

1 The data subject has given his explicit consent to the processing of the

personal data.

2 (1) The processing is necessary for the purposes of exercising or

performing any right or obligation which is conferred or imposed by law on

the data controller in connection with employment.

(2) The Secretary of State may by order:

(a) exclude the application of sub-paragraph (1) in such cases as

may be specified, or

(b) provide that, in such cases as may be specified, the condition in

subparagraph (1) is not to be regarded as satisfied unless such further

conditions as may be specified in the order are also satisfied.

3 The processing is necessary:

(a) in order to protect the vital interests of the data subject or another

person, in a case where:

(i) consent cannot be given by or on behalf of the data subject, or

(ii) the data controller cannot reasonably be expected to obtain the

consent of the data subject, or

(b) in order to protect the vital interests of another person, in a case

where consent by or on behalf of the data subject has been

unreasonably withheld.

4 The processing:

(a) is carried out in the course of its legitimate activities by any body or

association which:

(i) is not established or conducted for profit, and

(ii) exists for political, philosophical religious or trade-union purposes,

(b) is carried out with appropriate safeguards for the rights and freedoms

of data subjects,


(c) relates only to individuals who either are members of the body or

association or have regular contact with it in connection with its purposes,


(d) does not involve disclosure of the personal data to a third party

without the consent of the data subject.

5 The information contained in the personal data has been made public as a

result of steps deliberately taken by the data subject.

6 The processing:

(a) is necessary for the purpose of, or in connection with, any legal

proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

(c) is otherwise necessary for the purposes of establishing, exercising or

defending legal rights.

7 (1) The processing is necessary for:

(a) the administration of justice,

(aa) the exercise of any functions of either House of Parliament,]

(b) the exercise of any functions conferred on any person by or

under an enactment, or

(c) the exercise of any functions of the Crown, a Minister of the

Crown or a government department.

(2) The Secretary of State may by order—

(a) exclude the application of sub-paragraph (1) in such cases as

may be specified, or

(b) provide that, in such cases as may be specified, the condition in

subparagraph (1) is not to be regarded as satisfied unless such further

conditions as may be specified in the order are also satisfied.


(1) The processing:

(a) is either:

(i) the disclosure of sensitive personal data by a person as a member of

an anti-fraud organisation or otherwise in accordance with any


arrangements made by such an organisation; or

(ii) any other processing by that person or another person of sensitive

personal data so disclosed; and

(b) is necessary for the purposes of preventing fraud or a particular kind

of fraud.

(2) In this paragraph “an anti-fraud organisation” means any

unincorporated association, body corporate or other person which enables

or facilitates any sharing of information to prevent fraud or a particular kind

of fraud or which has any of these functions as its purpose or one of its


8 (1) The processing is necessary for medical purposes and is undertaken


(a) a health professional, or

(b) a person who in the circumstances owes a duty of confidentiality

which is equivalent to that which would arise if that person were a health


(2) In this paragraph “medical purposes” includes the purposes of

preventative medicine, medical diagnosis, medical research, the provision

of care and treatment and the management of healthcare services.

9 (1) The processing:

(a) is of sensitive personal data consisting of information as to racial or

ethnic origin,

(b) is necessary for the purpose of identifying or keeping under review

the existence or absence of equality of opportunity or treatment between

persons of different racial or ethnic origins, with a view to enabling such

equality to be promoted or maintained, and

(c) is carried out with appropriate safeguards for the rights and freedoms

of data subjects.

(2) The Secretary of State may by order specify circumstances in which

processing falling within sub-paragraph (1)(a) and (b) is, or is not, to be

taken for the purposes of sub-paragraph (1)(c) to be carried out with

appropriate safeguards for the rights and freedoms of data subjects.

10 The personal data are processed in circumstances specified in an order

made by the Secretary of State for the purposes of this paragraph.