A lawful (or legal) basis for processing data must be satisfied before a business can process any personal data. Article 6 of the GDPR describes six scenarios when you are allowed to process data legally.
1. Data subject has given consent
The GDPR states that the individual’s consent must be:
- freely and clearly given,
- specific,
- informed, and
- unambiguous.
It is important to know that consent must be distinguished from all other text, for the individual to understand what data is collected from them and how it is used.
Individuals must be given an option to refuse or withdraw their consent at any time and without penalty. The companies must obey the withdraw and stop processing the individuals’ data.
The process of consent withdrawal needs to be done the same way as giving consent. It is the obligation of the company to demonstrate that the individual has given their consent to process their data.
If data is used for multiple purposes, then consent is required for every process separately.
2. There is an existing contract
The processing is necessary for the performance of a contract, or for taking steps at the request of the individual before entering into a contract.
For example, when an individual wants to open a bank account, he or she is requested to fill out a form with his or her personal details. This counts as a pre-contractual processing.
But, once the account is opened the bank would like to send you campaign offers as part of marketing activities, it needs to use your email address to be able to do so. In this situation, the bank must obtain your consent first to have a lawful basis.
3. Processing is necessary for compliance with a lawful obligation
The controller is obliged to processing if it is required by the EU or EU Member State law.
National laws may require companies to process personal data, for example, Estonian accounting law requires companies to preserve documents for 7 years, therefore the companies are bound by national laws to process data.
For public officials, legal obligation means that there is an official mission set for them by the law. For example, the tax department, police, and financial institutions are processing individuals’ personal data as it is their job.
4. Processing is necessary in order to protect the vital interests
This processing is necessary to protect the individuals’ life or physical integrity when in danger (emergency medical care) and when the data subjects are not able to give consent. This should be used only as a last resort.
For example, it is important that the ambulance staff can access the individuals’ medical data in case of an accident. Processing under vital interest is used mostly in extreme conditions and circumstances.
5. Processing is necessary for the performance of a task carried out in the public interest
The processing is necessary to perform a task in the public interest or of official functions, and the task or function has a clear basis in law.
Processing individuals’ data for the benefit of the public can be seen as public interest, for example, an outbreak occurred and the data processing can help with statistics and information flow. Processing data of a public figure is public interest when the interest of the public is high.
6. Processing is necessary for the purpose of the legitimate interests
The processing is necessary for companies interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
Legitimate interest may only be applied in situations, where there is a relevant and appropriate relationship between the individual and data processor.
Those situations can be for example a client and service provider relationship, where the client can reasonably expect that their data will be processed. When a company belongs to a group, transmitting the data between the group for internal administrative purposes is a legitimate interest.
Legitimate interest does not apply to public authorities processing personal data to perform their tasks.
Recording the lawful basis for each processing activity
According to the GDPR Article 30, the lawful basis should be recorded in the Record of Processing Activities.
The most simple way to manage and record all the processing activities is with a tool like GDPR Register.
More to read on this topic: Records of processing activities in GDPR Article 30
