MR JUSTICE WARBY Approved Judgment NT1 & NT2 v Google LLC taken place before it has effect. I do not myself detect such an approach as explicit or implicit in Google Spain. (2) I also reject Mr Tomlinson’s approach. As indicated when dealing with the Inaccuracy Issue, I do consider the flexibility of the remedies provided for by the DPA and DP Directive to be an important feature of the law in this area. But it would be unsatisfactory, and I think Ms Proops is right to say unprincipled, to leave so much to the discretion of the Court. (3) The solution that fits best with the structure of the law and the decision of the CJEU is, in my judgment, the one advocated by the ICO. But I am reluctant to take the radical step of disapplying any part of the DPA. There is a powerful argument that the scheme of the DPA is incompatible with fundamental rights, as it fails to recognise any possibility of a free speech justification for the processing of sensitive personal data without consent. But the same would seem to be true of the DP Directive which, in this respect, the DPA merely mirrors. The CJEU did not need to confront this issue in Google Spain, as the data in that case, though “sensitive” in the colloquial sense as they concerned personal financial matters, were not “special category data” within Article 8 of the DP Directive. In my judgment, it is not necessary to go as far as the ICO contends. On the facts of this case, at least, I need not confront the question of disapplication. I consider that a Schedule 3 condition is met. (3) The DPA Compliance Issue 106. The First Principle. On the facts of this case, the general requirements of this Principle, that processing be “fair and lawful” add nothing to the particular requirements, that processing comply with at least one Schedule 2 condition and, if the data are sensitive personal data, at least one condition in Schedule 3. Most of the personal data with which I am concerned are sensitive personal data and it is convenient to start with Schedule 3. 107. Schedule 3. I reject most of Google’s arguments that its processing was compliant with Schedule 3. The processing of NT1’s data by making them available to those who search on his name was not, nor is it, “necessary for the purposes of exercising legal rights” within Condition 6(c) of Schedule 3. The rights relied on those of internet users under Article 10 of the Convention and Articles 8 and 11 of the Charter, as well as the Article 16 freedom of Google to conduct a business. I do not consider that broad interpretation can stand. As Ms Proops and Mr Tomlinson submit, this condition must be applied in conformity with Article 8.2(e) of the DP Directive, which uses the terms “legal claims”; its “focus is on the protection of underlying rights”: R (British Telecommunications plc) v Secretary of State for Culture, Olympics, Media and Sport [2012] EWCA Civ 232 [2012] Bus L R 1766 [74]. 108. Google’s reliance on paragraph 7A of Schedule 3 is close to unarguable. That condition applies to processing of information “disclosed by an anti-fraud organisation”. It is said that this paragraph should be given a wide interpretation, encompassing both public and private sector organisations concerned with exposing and preventing wrongdoing. I have seen nothing to warrant such a broad interpretation of wording which, on its face, appears to be specific and relatively narrow in ambit.