Vital Interests and the GDPR

Of all the lawful bases for data processing under the GDPR, one stands out for urgent and life-saving situations —vital interests. As we embark on this exploration, our journey begins with understanding the critical importance of vital interests in the broader landscape of lawful data processing. Please note: this article discusses situations and scenarios that some readers may find distressing.

Contents

• What Does the GDPR Say?

• What Does This Mean?

  • Necessary

  • The Data Subject or Another Natural Person

  • Protect the Vital Interests

• Scenarios where Vital Interests May Apply

  • Important Considerations

• Alternatives to Vital Interests

What Does the GDPR Say?

Under Article 6 of the GDPR data processing is lawful if “[the”] processing is necessary in order to protect the vital interests of the data subject or of another natural person”

Note the following words:

• necessary

• protect the vital interests

• data subject or… another natural person

What Does This Mean?

Vital interests, within the GDPR framework, represent a legal pathway that allows the processing of personal data when it’s crucial to protect someone’s life. This fundamental definition establishes the basis for scenarios where time is of the essence.

However, like any legal concept, vital interests come with defined parameters and considerations. The processing must be proportional to the threat at hand, necessitating a meticulous understanding of its boundaries and justifications.

Article 6 of the GDPR outlines various lawful bases for data processing, with vital interests finding its place in situations where other grounds might be impractical or too time-consuming. This section provides a granular analysis of how vital interests align with and differentiate from other legal grounds.

Necessary

In order to apply this lawful basis the processing must be required. If you can achieve your outcomes without processing personal data, or by processing less, you cannot rely on vital interests.

If you can rely on another lawful basis, particularly, consent then you should try this first. Of course vital interests can cover some scenarios when seeking consent may not be possible or appropriate.

The Data Subject or Another Natural Person

Processing a person’s data under the vital interests lawful basis can be done to protect another person, not just the data subject. That means if it is necessary to protect a person’s life you may process the data of another person to do so.

An example might be processing the personal data of a person’s former partner because he or she presents a real threat to their former partner’s life. In this scenario you would not reasonably expect the former partner to agree to their data to be processed for this purpose.

Protect the Vital Interests

Vital interests means essential to protecting life. This can mean preventing death or preventing serious harm. Examples can include using medical information to provide life-saving medical care when someone is unconscious or incapable of understanding what is happening. It it not, however, a basis for providing medical care against someone’s will.

This lawful basis is by design a very limited legal basis that can only apply in some cases.

Scenarios where Vital Interests May Apply

This lawful basis under the GDPR allows organisations to process personal data when it’s necessary to protect someone’s life or a vital interest. However, as noted above it’s a narrow basis with strict conditions and should be used sparingly. The following situations may be scenarios where invoking vital interests might be appropriate:

1. Emergency Medical Care:

• A hospital needs to access a patient’s medical records in an emergency to diagnose and treat them effectively, potentially saving their life.

• Justification: Processing is necessary to protect the vital interest of the patient’s life and health.

2. Organ Donation Matching:

• A national organ donation registry needs to process personal data and medical information to quickly match potential donors with recipients requiring life-saving transplants.

• Justification: Processing is necessary to protect the vital interest of recipients in receiving potentially life-saving organ transplants, and there is not enough time to seek consent from every potential donor.

3. Disaster Response and Evacuation:

• Emergency services need to access location data and contact information during natural disasters or emergencies to locate and rescue individuals in danger.

• Justification: Processing is necessary to protect the vital interest of individuals’ lives and safety.

4. Protecting Children:

• Child protection services may need to process personal data to investigate potential child abuse or neglect, protecting vulnerable children from harm.

• Justification: Processing is necessary to protect the vital interest of children’s well-being and safety.

5. Preventing Serious Crimes:

• Law enforcement agencies may need to process personal data and communications data to prevent imminent threats to public safety or national security.

• Justification: Processing is necessary to protect the vital interest of the public from serious crimes and threats.

Important Considerations

• When relying on vital interests, organisations must demonstrate:

  • The existence of a genuine and concrete vital interest.

  • The necessity of processing personal data to protect that vital interest.

  • Proportionality of the processing to the vital interest being protected.

  • No other less intrusive means of achieving the same objective.

• Organisations should also:

  • Implement robust safeguards to protect the processed data.

  • Inform individuals about the processing and its justification under vital interests.

  • Be prepared to justify their actions to regulators or courts.

Alternatives to Vital Interests

In some scenarios, other lawful bases like statutory duty or legitimate interests might be more appropriate and easier to justify. Healthcare organisations or other public sector bodies should also be mindful of the public authority lawful basis as well.

Organisations should carefully consider all potential bases before relying on vital interests.

Remember, vital interests are a powerful but exceptional basis. Organisations should only use it when strictly necessary, respecting individual rights and data protection principles to ensure the protection of vital interests without undue intrusion into privacy.