Key References:

  • Art. 6(1)(c),(d),(e)
  • Art. 6(1)(e)
  • Art. 6(3)
  • Recitals 41, 45, 46

Obligations and Interests

  • Pursuant to Art. 6(1)(c)-(e), the controller’s legal obligation, data subjects vital interests, and public interests are other lawful bases for processing personal information under the GDPR.
  • The Recitals explain the type of obligations and interests envisaged by the GDPR.

Art. 6: Lawfulness of processing

1. Processing shall be lawful only if and to the extent that at least one of the following applies:
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

Legal Obligations:

  • Art. 6(3) and Recital 45.1 states that the controller’s legal obligation to process data under Art. 6(1)(c) “should have a basis in Union or Member State law” to which the controller is subject.
  • Recital 41 expands that controller’s legal obligations can arise from statutory and non-statutory obligations (e.g. legislative and common law, in other words EU or national laws, or CJEU, ECtHR and national case law). However, such legal basis should be “clear and precise”.
  • Recital 45 makes clear that member states laws can specify controllers’ legal obligations and govern the lawfulness of processing under Art. 6(1)(c).

Vital Interests:

  • Recital 46.1 limits data processing for vital interests only when it is “necessary to protect an interest which is essential for the life of the data subject or that of another natural person“.
  • Recital 46.2 further states that Art. 6(1)(d) should be relied on as lawful basis “only where the processing cannot be manifestly based on another legal basis“.
  • Finally, Recital 46.3 states that in some situations a data subject’s vital interests can overlap with public interests thus making it a lawful basis of processing. These include “humanitarian purposes” such as “monitoring epidemics”, “their spread or in situations of humanitarian emergencies, in particular in situations of natural and man-made disasters”.

Public Interest:

  • Recital 45 specifies that public authorities may rely on public interest under Art. 6(1)(e) to process data.
  • Art. 6(1).2 specifically prohibits public authorities from relying on legitimate interest in the performance of their tasks.
  • Art. 6(3) further states that when data is processed under Art. 6(1)(e) the public interests shall be laid down by Union law or the Member State law to which the controller is subject. Thus, the processing for public interest must have basis in law.