Personal data is exempt from —
(a) the Second, Third, and Fourth Data Protection Principles; and
(b) section 40, where the personal data consist of information in respect of which a claim to legal professional privilege or confidentiality as between client and legal practitioner could be maintained in legal proceedings, including prospective legal proceedings.