Article 6 Legal Basis

Like contractual obligations, an organization may proceed with data processing if it is required to do so by law. 2The purpose of the processing shall be defined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 3This legal basis may contain specific provisions aimed at adapting the application of the provisions of this Regulation, in particular: the general conditions for the lawfulness of processing by the controller; the types of data being processed; the persons concerned; the companies and purposes for which personal data may be disclosed; purpose limitation; storage periods; and processing operations and procedures, including measures to ensure lawful and fair processing as provided for in other specific processing situations under Chapter IX. 4In EU law or the law of the Member States corresponds to an objective of general interest and is proportionate to the legitimate aim pursued. However, the definition of the concept of contractual `nullity` does not seem easy, particularly in the light of single European law. Indeed, the regulation of contractual defects is generally left to the decisions of the national legislature, so that a particular defect in the contract may be a cause for nullity in some jurisdictions and nullity in others. Admittedly, there seem to be shortcomings of nullity common to European legal traditions: for example, lack of will, deception and threat. Beyond these exemplary cases, however, there are circumstances in which the infringement does not necessarily entail nullity but declarations of cancellation (of a contract initially valid, although erroneous). The processing activity is necessary for a legal obligation, such as information security, labor law or consumer business law. Member States may maintain or introduce provisions to specify and adapt the lawful processing requirements set out in Article 6(1)(c) of the GDPR (processing based on a “legal obligation”) and Article 6(1)(e) of the GDPR (“public interest”), as well as to ensure lawful and fair processing in relation to the specific processing situations described in Chapter IX of the GDPR. If consent is used as a legal basis for data processing, it must be given voluntarily, specifically, knowingly and unambiguously, indicating the data subject`s wish that his or her data be collected and processed for a specific purpose and period. A legitimate interest may be a legal, factual or economic interest.

It must be “legitimate”, i.e. more than just legal or possible. It must be “pursued by the controller or by a third party”, which means that it must be actively pursued. They must be an interest of the controller or a third party, but must not constitute a public interest (cf. Art. 6 para. 1 lit. e GDPR). It is crucial for any organisation to base its data processing on one of the following legal bases, depending on the type of data processed and the circumstances of the data processing in that particular case. If your goals change over time or if you have a new goal that you didn`t originally plan for, you may not need a new legal basis as long as your new goal is in line with the original goal. The public work base is more relevant to much of what you do.

If you are a public authority and can demonstrate that the processing is for the purpose of performing your duties under UK law, you can use the database for public tasks. But if it`s for a different purpose, you can always consider a different foundation. ☐ We have examined the purposes of our processing activities and selected the most appropriate legal basis (or legal bases) for each activity. The basic approach is the same. You should think about your goals and choose the foundation that suits you best. You can always use our legal base tool to help you. According to recital 45 of the GDPR, the GDPR “does not require specific law for each individual processing”. “A law as the basis for several processing operations …

may be sufficient. “​​. The processing of personal data based on the vital interests of another natural person should, in principle, take place only where the processing cannot be manifestly based on another legal basis … This means that the protection of vital interests is not considered the legal basis if the controller is able to adequately protect the vital interests of the person in another, less intrusive way. A legal obligation in this case may mean customary law or legal principles in any country where the GDPR is applied. This means that the obligation must be established by Union law or the applicable law of the Member States, including obligations under ordinary law, and in order to be able to rely on that legal basis as a basis for data processing, it is essential that personal data are processed by law. Download our white paper on the legal requirements of the GDPR for the collection of personal data in order to understand in detail the 6 legal bases and identify the most appropriate legal bases for your data processing situation. The possibility of legally processing information for purposes that are not directly correlated with the original, but where there is a very high level of safeguards, is not yet clear according to the relevant law or case law. [21] Vital interests of the individual. An organization is likely to be able to rely on vital interests as a legitimate basis for protecting an individual`s life.

However, he cannot claim vital interests in health data or other data of special categories if the person is able to give his consent, even if he refuses his consent. A common example of this base is that of banks. Banks may process the personal data of their users due to their legal obligations both under the law of the country and under international banking regulations, tax laws and anti-money laundering laws. This legal basis can be used in the following two cases: This is an appropriate legal basis if the data processing is necessary for the purposes of the legitimate interests of the controller or a third party. An EU court ruling can help organisations better understand this particular legal basis. Some of the legal bases relate to a specific purpose – a legal obligation, the performance of a contract with the person, the protection of a person`s vital interests or the performance of your public duties. If you are dealing for these purposes, the appropriate legal basis may very well be obvious, so it is worth taking this into account first. However, the uncertainty mentioned above seems to be further limited, at least in some areas, by the existence of common European principles.

In this respect, for example, the principles of contractual fairness towards the consumer, as set out in Directive 93/13/EEC on unfair terms and other related Directives. Example: A Spanish controller and a French consumer have entered into a contract that is illegal under current French law. The absence of a valid contract means that there is no legal basis. The principle of accountability requires that you can demonstrate that you comply with the UK GDPR and that you have appropriate policies and processes in place.