Article 21

1.          The prohibition on processing of personal data concerning a person’s health, referred to in Article 16, does not apply if the processing takes place by:

a.       care providers, health care or social services institutions or facilities to the extent that this is necessary with a view to good treatment or care of the person concerned, or for the management of the relevant institution or professional practice;

b.       insurers as referred to in Article 1 of the national ordinance on supervision of insurers, and

financial service providers that mediate in insurance as referred to in that national ordinance, to the extent that this is necessary for:

1°.     the assessment of the risk to be insured by the insurer and the person concerned has not made any objection; or

2°.     the execution of the insurance contract;

c.       schools to the extent that this is necessary with a view to the special supervision of students or for making special provisions in connection with their health;

d.      a probation institution, a special probation officer and the Guardianship Council, a family supervisor, or a legal entity as referred to in Article 302(1) of the Civil Code, to the extent that this is necessary for the execution of their statutory duties;

e.       the Minister, to the extent necessary in connection with the execution of penal sentences or custodial measures; or

f.         administrative bodies, pension funds, employers or institutions working on their behalf, to the extent necessary for:

1°.     proper execution of statutory provisions, pension schemes or collective labour agreements that provide for claims that are dependent on the health of the person concerned or

2°.     the reintegration or supervision of employees or benefit claimants in connection with illness or occupational disability.

2.          In the cases, referred to in the first paragraph, the data are processed only by persons required to protect confidentiality on official, professional or statutory grounds or pursuant to a confidentiality agreement. If the responsible party processes data personally and is not already required to protect confidentiality on official, professional or statutory grounds, he is required to protect the confidentiality of the data, except to the extent that he is required to report these pursuant to the national ordinance or the need arises through his duties to report the data to other persons authorised to process these pursuant to the first paragraph.

3.          The prohibition on processing other personal data as referred to in Article 16, does not apply to the extent that this is necessary in addition to the processing of personal data concerning a person’s health as referred to in paragraph 1(a) with a view to good treatment or care of the person concerned.

4.          Personal data concerning hereditary characteristics may only be processed to the extent that such processing takes place with regard to the person concerned from whom the relevant data were obtained, unless:

a.       a serious medical interest takes precedence or

b.       the processing is necessary for scientific research or statistical purposes.

In the case, referred to in b, Article 23(1a) and Article 23(2) are likewise applicable.

5.          In a national decree containing general measures, further rules may be laid down with regard to the application of paragraph 1(b) and 1(f).