Common use of FAIR AND LAWFUL PROCESSING Clause in Contracts

FAIR AND LAWFUL PROCESSING. 5.1 Each Party shall ensure that it processes the Shared Personal Data fairly and lawfully in accordance with clause 5.2 during the Term of this Agreement. 5.2 For the purposes of Agreed Purposes 1-3 as listed in clause 2.5 of this Agreement, each Party shall ensure that it Processes Shared Personal Data on the basis of one of the following legal grounds: (a) processing is necessary for the purposes of the legitimate interests pursued by the Parties except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the Data Subject (DPA Sch 2.6.1) or, in the case of data sharing on or after the 25th May 2018: (b) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (GDPR Art 6. 1 (e) ) or, (c) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data (GDPR Art 6. 1 (f). 5.3 For the purposes of Agreed Purpose 4 as listed in clause 2.5 of this Agreement, each Party shall ensure that it Processes shared Personal Data on the basis of the legal grounds as listed in clause 5.2. Where Sensitive Personal Data or Special Category Data is shared this will be on the following additional grounds: (a) the processing of Sensitive Personal Data is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons— (i) holding different beliefs, or (ii) of different states of physical or mental health or different physical or mental conditions, with a view to enabling such equality to be promoted or maintained, providing: - the data use does not support measures or decisions with respect to any particular data subject otherwise than with the explicit consent of that data subject; and - does not cause, nor is likely to cause, substantial damage or substantial distress to the data subject or any other person. (DPA Sch 3.10.7.1) or, in the case of data sharing on or after the 25th May 2018: (b) processing of Special Category Data is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject (GDPR Art 9.2 (g) 5.4 For the purposes of Agreed Purpose 5, as listed in clause 2.5 of this Agreement, Personal Data (as listed in clause4.1) and Sensitive Personal Data/Special Category Data (as listed in clause 4.2) may be shared in addition to Personal Data relating to alleged or actual criminal offences, breaches of codes of conduct or student rules and regulations, only where one of the following lawful grounds apply: a) the processing in necessary for the exercise of any functions conferred on any person by or under an enactment (DPA Sch 3.7.1 (b) ) b) The processing in necessary in order to protect the vital interests of the data subject or another person where the data subject is physically of legally incapable of giving consent (DPA Sch 3.1) (GDPR Art 9.1 (c) ) or, in the case of data sharing on or after the 25th May 2018: c) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject (DPA Sch 3.10.1.1.a) (GDPR Art 9.2 (g) ). 5.5 Both Parties shall, in respect of Shared Personal Data, ensure that their privacy notices are clear and provide sufficient information to Data Subjects in order for them to understand what of their Personal Data the Parties are sharing, the circumstances in which it will be shared, the purposes for the data sharing and either the identity with whom the data is shared or a description of the type of organisation that will receive the Personal Data. 5.6 Both Parties undertake to inform Data Subjects of the purposes for which it will process their Personal Data and provide all of the information that it must provide in accordance with its own applicable laws, to ensure that the Data Subjects understand how their Personal Data will be processed by the Data Controller.