The Lawful Bases for Data Processing

The Lawful Bases for Data Processing are set out in the UK GDPR. In this article we will introduce each of the lawful bases and how they apply.

Contents

• The Core Principles of GDPR

• What is Personal Data Processing?

• The Lawful Bases for Data Processing

  • Consent

  • Contractual Obligations in Data Processing

  • Understanding Legal Obligations in Data Processing

  • Vital Interests: Protection of Life

  • Public Task: Processing for Official Functions

  • Legitimate Interests

• Conclusion: Understanding Lawful Bases for Data Sharing

The Core Principles of GDPR

The GDPR is underpinned by six core principles. These are different to the lawful bases, but are linked. The first privacy principle says that the processing of personal data must be lawful, fair and transparent. This is why you must have a lawful basis for any data processing. You must also be able to explain your data processing and the lawful basis for it to people (“transparency”).

You can read more about the first GDPR privacy principle here.

The other core principles are

• purpose limitation

• data minimisation

• accuracy

• storage limitation, and

• integrity and confidentiality

In addition to these six core principles there is also the principle of accountability. This says that people processing personal data are accountable for demonstrating compliance with the privacy principles. This is another reason why understanding the lawful bases for data processing is important.

You can learn more about the principle of accountability here.

What is Personal Data Processing?

Personal data is anything that by itself or in combination with other data could lead to a person (data subject) being identified. This is a very broad definition. Any organisation that uses information about people for business purposes is processing personal data and needs to comply with the GDPR.

• learn more about personal data processing here.

The Lawful Bases for Data Processing

There are six main lawful bases for data processing under the GDPR. For some types of sensitive personal data an additional lawful basis is needed on top of the main bases set out below.

We’re not going to go through these additional lawful bases here, but you can read about sensitive personal data here.

Consent

Consent is one lawful basis for data processing. It is no more or less important than any other lawful basis. Consent works best in limited circumstances, and it must be:

• freely given

• given by clear and positive action (opt-in rather than opt-out)

• able to be withdrawn at any time

Consent is suitable to activity like marketing, the use of personal data for research purposes, or

Contractual Obligations in Data Processing

In certain instances, data processing is necessary for the fulfillment of a contract. Understanding and clearly defining these contractual obligations is crucial to ensuring lawful processing.

Examples of contracts that require personal data processing include employment contracts or the contract to have goods ordered online delivered.

Understanding Legal Obligations in Data Processing

Organisations must process personal data when it is required to comply with a legal obligation. This includes scenarios where data must be reported to regulatory authorities or disclosed in response to a court order.

For example, employers in the UK have a statutory duty to process personal data to check if people are legally entitled to work in the UK. Doctors also have some statutory duties to report concerns if they feel there are safeguarding issues relating to their patients.

Vital Interests: Protection of Life

Data processing becomes lawful when it is necessary to protect someone’s life. This is particularly relevant in emergency healthcare situations and crisis response scenarios. However, this lawful basis can also apply if you wish to protect someone from serious harm.

The person whose data process under this lawful basis does not need to be the person who needs protection. For example, occasionally the police will release details of a dangerous criminal in order to appeal for information and warn the public to stay away from him or her.

Public Task: Processing for Official Functions

Public authorities or organisations carrying out official functions may process personal data under this lawful basis. It’s essential to define the specific tasks and functions that justify data processing. This is because the public task must relate to the statutory basis on which the public authority operates.

For example hospitals will process personal data to deliver healthcare under the NHS Act, even if the Act does not specify that data processing is necessary for this task. However, the personal data must be processed to provide effective healthcare.

Legitimate Interests

Legitimate interests is probably the most flexible of the lawful bases under the GDPR. For this lawful basis to apply you must:

• be able to define the legitimate interest or interests that allow the personal data to be processed, and

• ensure there is a minimal impact on the privacy of the people affected.

Like vital interests it does not have to be the legitimate interests of the data subject that allow his or her data to be processed. Because of the need to have a minimal impact on the data subject you will need to know if there is anything that could make them a vulnerable person. For example legitimate interests is harder to justify if the person is a child.

Conclusion: Understanding Lawful Bases for Data Sharing

Understanding and correctly applying the lawful bases for data sharing under GDPR is essential for organisations seeking GDPR compliance. Transparent and ethical practices not only meet regulatory requirements but also build trust with individuals whose data is being processed. The intricate dance of lawful data sharing involves constant awareness, ethical considerations, and a commitment to upholding the rights and freedoms of individuals in the digital age.