5
(1)
The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of those provisions would prevent the controller from complying with that obligation.
(2)
The listed GDPR provisions do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the application of those provisions would prevent the controller from making the disclosure.
(3)
The listed GDPR provisions do not apply to personal data where disclosure of the data—
(a)
is necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings),
(b)
is necessary for the purpose of obtaining legal advice, or
(c)
is otherwise necessary for the purposes of establishing, exercising or defending legal rights,
to the extent that the application of those provisions would prevent the controller from making the disclosure.
Cases considering Schedule 2, paragraph 5 3
[2020] EWCA Civ 1032 · 6 August 2020Limits
Paragraph 5 was identified as the restriction concerning information required in connection with legal proceedings. (see para [44])
Paragraph 5(3) permitted disclosure where necessary for legal proceedings or for establishing, exercising or defending legal rights, to the extent required to avoid preventing disclosure. (see paras [45]-[47])
[2025] EWHC 1824 (KB) · 22 July 2025Disapplies
The court held that purpose limitation and related information rights did not prevent necessary disclosure for establishing, exercising or defending legal rights.
[2019] UKUT 126 (IAC) · 8 March 2019
The exemption for disclosure necessary for, or in connection with, legal proceedings restricted the appellant’s data-subject rights to the extent needed for the appeal. The Tribunal held the provision compatible with GDPR Article 23 (see paras [37]-[38]).
The exemption for disclosure otherwise necessary to establish, exercise or defend legal rights restricted the appellant’s data-subject rights to the extent needed for the appeal. The Tribunal held the provision compatible with GDPR Article 23 (see paras [37]-[38]).
What each judgment says about Schedule 2, paragraph 5 is in the case-law panel in the full Act.