Vital interests is a lawful basis for processing personal data under the GDPR. it is narrow in scope, but was set out to allow for data use in emergency and life threatening situations.
Vital Interests at a Glance
When can you process someone’s personal data without their consent because their life—or somebody else’s—is at risk? Vital interests:
- is a lawful basis under Article 6(1)(d);
- is deliberately narrow;
- usually concerns matters of life and death;
- requires processing to be necessary;
- may protect the individual whose data you process or another person.
In addition
- processing must be necessary: if a reasonable, less intrusive alternative exists, vital interests may not apply.
- It is generally unsuitable for routine or planned processing.
- additional rules apply when special category data are involved.
- organisations should document why they relied on this basis
In short, vital interests is an emergency lawful basis, not a general basis for processing information because doing so could protect someone’s health, safety or wellbeing.
What Does Article 6(1)(d) Say?
The UK GDPR is quite straightforward:
Processing shall be lawful only if and to the extent that… processing is necessary in order to protect the vital interests of the data subject or of another natural person;
What Does “Vital Interests” Mean?
Recital 46 of the GDPR describes vital interests as those interests essential for the life of the data subject or another natural person.
It also notes “some types of processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread or in situations of humanitarian emergencies, in particular in situations of natural and man-made disasters“.
Vital interests does not necessarily mean saving a life, but it does mean protecting life so vital interests could be used to protect people from harm, or being the cause of harm, if no other lawful basis can apply.
The Three Key Tests
Is the processing necessary? The processing must be completely necessary; if you can achieve the same safety outcome using a less intrusive method, you cannot use this basis,
Is there no alternative basis? For example you could process the data with consent if the person is conscious and capable of managing their own affairs, or recognised legitimate interests for a safeguarding scenario.
Is this routine processing? For example planned or elective medical care could be life saving but as routine medical activity. Similarly relatively common activities like health and safety cannot fall under this lawful basis.
Remember the principle of accountability. You are accountable, if relying on vital interests, for demonstrating you have considered these tests. It is important to avoid stretching the application of vital interests beyond “life and death” scenarios
Vital Interests and Special Category Data
Emergency situations frequently involve health information, which is special category data. Special category data has additional protections under the GDPR and processing it requires a second lawful basis under Article 9 of the GDPR (you can read more about special category data here).
Article 9 does allow the processing of special category data like health information when the data subject gives consent. Unfortunately if a competent person refuses consent, even if the data processing would save their life, then you cannot rely on vital interests to overrule them. Vital interests cannot be used as an alternative if someone refuses life saving intervention.
Article 9(2)(c): When Someone Cannot Give Consent
Where someone cannot give consent then Article 9(2)c allows the processing of special category data in relation to vital interests. Examples when this might apply are:
- a person is unconscious
- they are too young to understand the consequences of not giving consent
- another situation where someone is not capable of consenting
Examples of When Vital Interests May Apply
Vital interests may apply in a range of scenarios such as:
- Providing information about a colleague’s pre-existing medical conditions when calling emergency services after they have lost consciousness
- Emergency disclosure: An unconscious accident victim is admitted to hospital. Relevant medical information is accessed and shared with clinicians so they can provide emergency treatment.
- Protecting somebody else: Information about a parent needs to be processed because it is necessary to protect their child’s life.
When Vital Interests Should NOT Be Used
Because vital interests is a very narrow lawful basis, and because lawful bases like legitimate interests and recognised legitimate interests exist many overtly emergency situations cannot rely on vital interests.
Examples include:
- an pub worker phoning the police to report a drunk customer has just driven off in a car
- a GP phoning an ambulance after examining them during a home visit
- telling people to avoid a particular area because of a gas leak
Vital interests cannot be extended to cover related purposes such as learning from incidents, handling complaints or training.
Protecting Another Person’s Vital Interests
The Vital interests lawful basis does allow for the processing of personal data to protect the vital interests of someone other than the data subject. For example, if an unconscious child is being treated for a life-threatening condition and doctors urgently need relevant family medical history. Processing information about a parent could potentially be necessary to protect the child’s life.
You might also be able to rely on vital interests to share the data of a person who presents an immediate threat to the life of others on the grounds of individual or public protection. However, for both of these scenarios you may be able to rely on other lawful bases and it will be important to work through and record your reasoning for relying on vital interests.
What Data Should You Process?
It is important to process only the minimum necessary data to protect the vital interests in question. Because this lawful basis has limits once the immediate danger or emergency is over any further or additional data processing will need another lawful basis – do not treat the lawful basis in a way that could lead to open-ended data processing.
So, continuing the medical example, sharing data about an unconscious colleague with emergency services might mean any pre-existing conditions, key medical history, medications and allergies but not data unrelated to the issue at hand such as unrelated sickness absences.
Transparency, Security and the Other GDPR Principles
One of the difficulties with vital interests is recording the processing in your record of processing activity and your privacy information. Because the need to share and process personal data for vital interests will by definition be rare and ad-hoc it can be hard to reflect it in these core statutory documents. However, you must consider the possibility – particularly if you are an employer or deal with children – that this situation may arise and note that where necessary limited data will be shared to protect life in emergency situations.
There is no need to go into great detail, and of course in any specific emergency situation providing real time privacy information will not be a priority. However, thinking about this will also be a good starting point for considering who should share information and how. For example, thinking about emergency care for an unconscious colleague, should it be his or her line manager? HR? Where will relevant medical information be stored, and how will you protect it from unauthorised access?
Documenting and Demonstrating Your Decision
If you ever need to rely on the vital interests lawful basis for processing personal data document:
- whose vital interests were at risk;
- the nature and immediacy of the threat;
- what personal data was involved;
- why processing was necessary;
- the alternatives considered;
- why they weren’t sufficient;
- any Article 9 condition where applicable;
- the information disclosed and to whom;
- safeguards used;
- the decision maker;
- any subsequent review.
As noted above you are likely to find it helpful to consider in advance where the basis may be relevant, documenting those circumstances and being able to justify the reasoning.
Common Mistakes
The mistakes organisations make with vital interests include:
- misunderstanding “vital”. In this context it means life or death situations, not core or important business activities. Although there are some data processing activities that are vital for a business to function, vital interests will not be the lawful basis for doing them
- not considering necessity or alternatives: when an emergency arises data can and should be shared but it may be, when documenting the data sharing, another lawful basis will be a better fit.
- not limiting data sharing: vital interests do not justify general access to personal information. In a medical situation vital interests means sharing sufficient information to deal safely with the presenting emergency, not access to a person’s entire medical record.
Getting Vital Interests Right
We have produced two resources that you can download below to help you navigate vital interests. The first is a decision framework to help you decide if and when vital interests might be an applicable lawful basis. The second is a checklist to help you apply it in a GDPR compliant and defensible way.
Vital Interests Decision Framework
Practical Checklist
Before relying on Article 6(1)(d), ask:
☐ Whose life are we protecting?
☐ What is the actual threat?
☐ Is the threat sufficiently serious to involve a vital interest?
☐ Why is processing personal data necessary?
☐ Could we reasonably achieve the objective another way?
☐ Are we processing one person’s data to protect another?
☐ Does another lawful basis clearly apply?
☐ Are special category data involved?
☐ If so, what is our Article 9 condition?
☐ If relying on Article 9(2)(c), is the individual physically or legally incapable of giving consent?
☐ Are we processing only the information necessary?
☐ Have we applied appropriate security safeguards?
☐ Have we documented why we relied on vital interests?
Download These Resources Here
Conclusion
Vital interests doesn’t mean processing that benefits or protects someone; it is a narrow basis for processing that is necessary to protect a life. Its narrowness and focus means it may never be used by most organisations, but that also means when it is needed it needs to be understood. Vital interests will set within a wider set of data collection and processing, and often depend on special category – medical – data so the wider implications of this lawful basis also need to be understood. Getting vital interests right depends on understanding proportionality and necessity, and being able to justify your decisions if you consider no other lawful basis can apply.