Authorisation concerning data subject’s religious or philosophical beliefs
28. (1) The prohibition on processing personal information concerning a data
subject’s religious or philosophical beliefs, as referred to in section 26, does not apply if the processing is carried out by—
(a) spiritual or religious organisations, or independent sections of those
(i) the information concerns data subjects belonging to those organisations;
(ii) it is necessary to achieve their aims and principles;
(b) institutions founded on religious or philosophical principles with respect to
their members or employees or other persons belonging to the institution, if it
is necessary to achieve their aims and principles; or
(c) other institutions: Provided that the processing is necessary to protect the
spiritual welfare of the data subjects, unless they have indicated that they
object to the processing.
(2) In the cases referred to in subsection (1)(a), the prohibition does not apply to
processing of personal information concerning the religion or philosophy of life of family members of the data subjects, if—
(a) the association concerned maintains regular contact with the family
members in connection with its aims; and
(b) the family members have not objected in writing to the processing.
(3) In the cases referred to in subsections (1) and (2), personal information concerning a data subject’s religious or philosophical beliefs may not be supplied to third parties without the consent of the data subject.