Public Authority Basis for Data Processing

Navigating GDPR: Understanding the Public Authority Basis

In the complex landscape of GDPR compliance, public authorities occupy a unique position. Because they must exercise their powers and duties they need a specific lawful basis for processing data. A data subject will interact with a number of public bodies through his or her lifetime and therefore they will need to share personal data to be able to access public services and for services to be planned and delivered.

Contents

• What Does the GDPR Say?

• Public Authority Data Processing: Real-World Examples under the GDPR

• Understanding the Public Authority Basis

  • Legitimate Interests and Public Authorities

  • Processing Special Category Data

• GDPR Rights and the Public Authority Basis

• Data Privacy Principles

What Does the GDPR Say?

Article 6(f) of the GDPR reads that processing personal data is lawful if:

the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

Key Terms

• necessary: the processing of personal data under this lawful basis must be targeted and proportionate. That means if you do not need to process personal data to achieve your objectives, you cannot rely on this lawful basis to justify data processing that you want to do.

• public interest: you can rely on this lawful basis if you are either performing a specific task set out in law, or you are exercising official authority set out in law. Your organisation does not have to be a public body to rely on this lawful basis.

• controller: the data controller is the person who decides what data is needed and the purposes it is needed for. They hold ultimate accountability for GDPR compliance.

The GDPR does not require there to be a specific law setting out a statutory basis for every instance of data processing. However, the overall task that you are processing the data for must be set out in law.

Public Authority Data Processing: Real-World Examples under the GDPR

The GDPR’s “public authority basis” allows organisations acting in the public interest to process personal data under specific conditions. Here are some examples of the public authority basis in action:

1. Law Enforcement and Public Safety:

• Crime investigation: Police can collect and analyse CCTV footage, phone records, and DNA samples to investigate criminal activity and identify suspects.

• Emergency response: Ambulance services can gather location data and medical information to efficiently deploy resources and provide timely assistance.

• Traffic management: Public authorities can utilise traffic cameras and license plate readers to monitor traffic flow, enforce regulations, and ensure road safety.

2. Tax Administration and Revenue Collection:

• Tax assessments: Financial authorities can process income and investment data to calculate tax liabilities and ensure fair taxation.

• Social security payments: Governments can collect and use personal information to administer social security benefits and pensions accurately.

• Customs control: Border agencies can gather passport details and travel history to identify potential security threats and ensure compliance with customs regulations.

3. Public Health and Disease Control:

• Contact tracing: Health authorities can gather information on contacts of infected individuals during outbreaks like COVID-19 to prevent further spread.

• Vaccination programs: Healthcare institutions can record vaccination data to ensure population immunity and track vaccination rates.

• Public health surveillance: Public health agencies can analyze demographic and disease data to identify health trends and implement targeted prevention measures.

4. Education and Social Welfare:

• School admissions: Education authorities can process student data for school placements and allocate resources effectively.

• Social assistance programs: Government agencies can manage data on beneficiaries to administer welfare programs fairly and efficiently.

• Child protection: Social services can collect and analyze information to investigate potential child abuse or neglect and ensure child safety.

5. Environmental Protection and Regulatory Compliance:

• Environmental monitoring: Regulatory bodies can utilise data from sensors and monitoring devices to track pollution levels and enforce environmental regulations.

• Waste management: Public authorities can process data on waste collection and disposal to optimise waste management systems and minimize environmental impact.

• Product safety: Regulatory agencies can gather information on product complaints and accidents to identify defective products and ensure public safety.

Remember, some of these activities will be set out in specific statutes while others will be covered by official authority functions. By understanding these real-world examples, organisations can leverage the public authority basis compliantly and contribute to efficient public services while ensuring individual privacy rights are respected.

Understanding the Public Authority Basis

The public authority basis is not a one-size-fits-all category. To comprehend its implications, we must first define its scope and identify the entities falling under this classification. It extends beyond governmental bodies, encompassing various organisations entrusted with public tasks.

Legitimate Interests and Public Authorities

If you can rely on the public authority lawful basis then you should not rely on legitimate interests for data processing. This doesn’t mean public bodies can never use legitimate interests, it’s just that the public authority basis comes first.

Processing Special Category Data

Special category data like health related data requires an additional lawful basis for processing. The GDPR says data of this type can be processed with the explicit consent of the data subject. There are also a number of other lawful routes for processing sensitive personal data under the GDPR that may be combined with the public task basis:

• Explicit consent

• Employment, social security and social protection (if authorised by law)

• Vital interests

• Not-for-profit bodies

• Made public by the data subject

• Legal claims or judicial acts

• Reasons of substantial public interest (with a basis in law)

• Health or social care (with a basis in law)

• Public health (with a basis in law)

• Archiving, research and statistics (with a basis in law)

GDPR Rights and the Public Authority Basis

People’s GDPR rights vary slightly depending on the lawful basis that is used to process their data. A data subject can’t have their data deleted like they can if the lawful basis you are using is consent, and they do not have the right to data portability too. However, they can still exercise their right to object. A data subject can exercise their right to object if they have concerns about the accuracy or completeness of the data the public authority holds.

Data Privacy Principles

The foundational principles of GDPR, including transparency, lawfulness, and fairness, are equally applicable to public authorities.

You can find out more about the privacy principles by following the links but at their core:

• alongside a lawful basis your processing must also be fair and transparent

• you must only use the data for the purposes you collected it for (purpose limitation)

• ensure you use only the minimum necessary data

• you need to ensure the data are accurate and up to date

• data needs to be kept safe and secure

• delete the data when it is no longer needed

Like any other data controller public authorities are accountable for their compliance with the privacy principles.