(1) Processing of special categories of personal data shall be lawful where the processing is carried out in accordance with regulations made under subsection (3).
(2) Article 10 data may be processed where the processing is carried out in accordance with regulations made under subsection (3).
(3) Regulations may be made authorising the processing, where necessary for reasons of substantial public interest, of either or both of the following -
(a) special categories of personal data, and
(b) without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016, Article 10 data.
(4) Without prejudice to the generality of subsection (3), regulations made under that subsection shall identify -
(a) the substantial public interest concerned, and
(b) the suitable and specific measures to be taken to safeguard the fundamental rights and freedoms of data subjects in processing the personal data which is authorised by the regulations.
(5) For the purposes of subsection
…