Legal Basis for Personal Data Processing

#5.1 Preliminary Remarks

First of all, let us divide personal data into broad categories. The GDPR recognises the following types of data:

(1) ‘ordinary’ personal data, i.e. all data other than (2) and (3) below, for which the grounds for processing are provided for in Article 6 GDPR, while Articles 7 and 8 GDPR lay down more specific conditions for consent, including a child’s consent;

1. 2)special categories of personal data, which in general cannot be processed except when an exception provided for in Article 9 GDPR applies;
2. 3)so-called criminal data, i.e. personal data ‘relating to criminal convictions and offences’ (convictions, breaches of law and security measures), which as a rule cannot be processed either, unless authorised under separate laws or under the control of an official authority (Article 10 GDPR).

#5.2 ‘Ordinary’ Personal Data: Articles 6–8 GDPR

A list of grounds for processing ‘ordinary’ personal data is given in Article 6(1) GDPR, under which data processing is permitted on the basis of:

1. 1)consent – ‘the data subject has given consent to the processing of his or her personal data for one or more specific purposes’ (Article 6(1)(a) GDPR);
2. 2)performance of or entering into a contract – ‘processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’ (Article 6(1)(b) GDPR);
3. 3)legal obligation – ‘processing is necessary for compliance with a legal obligation to which the controller is subject’ (Article 6(1)(c) GDPR);
4. 4)vital interests – ‘processing is necessary in order to protect the vital interests of the data subject or of another natural person’ (Article 6(1)(d) GDPR);
5. 5)public task, exercise of official authority – ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’ (Article 6(1)(e) GDPR);
6. 6)legitimate interests pursued by the controller or by a third party – ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child’ (Article 6(1)(f) GDPR).

Although literature on this subject has stressed for a long time that the grounds listed above are completely autonomous, independent, and unrelated, there are still firms and even administrative authorities that treat data processing as being the equivalent to having consent to data processing. The following clause is a typical example of an error in this regard. It can frequently be found on online shopping websites: ‘I give consent to personal data processing to XYZ sp. z o.o. with its registered office in Milan, Via Monte Napoleone 90210, for purposes related to processing of an order’. It is clear even upon a brief glance at the list of grounds given above that in such a case, where data are necessary to perform a contract, the fact alone that the contract is entered into authorises to process data, of course only for purposes related to performance of the contract. Therefore there is no need to obtain consent for this purpose, and this clause is even misleading because it wrongly suggests that the party concerned can withdraw that consent.

Supervisory bodies usually recommend to pick one appropriate lawful basis for processing if more than one is available. In our opinion, controller can specify multiple lawful basis for processing data. In practice this can even be a frequent occurrence (especially when performance of a contract mixes with legitimate interest or some scope of data is processed under ‘entering into contract’ basis, but some other requires consent), but nevertheless, from the point of view of lawfulness of data processing, one lawful basis is sufficient and preferred to many.

The most important issue is that the controller is responsible for selecting the appropriate grounds.

#5.2.1 Consent of a Data Subject as Basis for Processing

Consent is probably the most often used legal basis for personal data processing. However, it is overused. It is also treacherous as at any time it can be withdrawn, and when it is not freely given or informed, it is not valid. The ‘recourse to consent’ results often from reluctance to rely on legitimate interest of a data controller or legitimate interest of a third party. It may also result from poor understanding or just disregarding of the EU data protection law, where a forced consent comes into play. Consent is not a viable ground for a business process requiring transfer of personal data out of EU as there need to be an intra-EU subsidiary process in place for all who decide to reject or withdraw their consent.

Processing of personal data is allowed when, according to Article 6(1)(a) GDPR:

the data subject has given consent to the processing of his or her personal data for one or more specific purposes.

or According to Article 9(2):

the data subject has given explicit consent to the processing of those personal data for one or more specified purposes….

We describe requirements for consent to be effective a few paragraphs below, in a separate chapter specifically discussing consent.

#5.2.2 Entering into and Performance of a Contract

The grounds described in Article 6(1)(b) GDPR can be cited by a controller in two situations, and these are:

1. 1)when the data processing is necessary for performance of a contract, or
2. 2)when the data processing is necessary for the taking of steps before a contract is entered into, while this must be at the request of the data subject (pre-contractual exchange of information).

#5.2.2.1 Actions Before a Contract Is Entered into (Pre-contractious)

Let us start with exchange of information for the purpose of entering into a contract. We are allowed to process personal information of a person wishing to enter into a contract with us. If the person states that intention, this is a basis for processing their data without which the contract cannot be entered into in the form expected by that person. Therefore, if a person contacts us with an intention to enter into a contract with us, we do not need to request her consent to process related personal data of that person.

#5.2.2.2 Performance of a Contract

It is possible to process the personal data necessary for the contract to be performed. This applies to performance of the contract by either party, i.e. the elements of the contract not only pertaining to themselves but also causing performance of the contract by the other party. Processing a client’s data in order to enforce remuneration for performing a contract from that client constitutes processing for performance of that contract. At the same time, it is processing based on a legitimate interest of the controller (Article 6(1)(f) GDPR). When a data controller decides to sell receivables, passing personal data of debtors to a purchaser will be based solely on a legitimate interest of the controller.

#5.2.2.3 Processing Third-Party Data

Technically entering into or performing a contract can serve as a legal basis for data processing only for data of a party to the contract.

If, in the context of the contract, we acquire knowledge about another person than a party to a contract (insured, a beneficiary, person who receives flowers on their birthday) we need to rely on grounds other than entering into or performing of a contract. This will usually be the legitimate interest of the controller or a party to a contract (grounds under Article 6(1)(f) GDPR). Performance of a contract with the party that entered into the contract with the controller will constitute this legitimate interest of the controller.

According to a literal interpretation of the GDPR, as a rule, in such a situation that third party should be informed that their data has been obtained and processed. There are exemptions from this obligation, for instance, where the law clearly lays down the rules for obtaining that information, or where the information constitutes professional secrets (e.g., privileged insurance information or information subject to attorney–client privilege).

The purpose of data processing in order to enter into/perform a contract is also narrow, because it is limited to that necessary for the parties to meet obligations under the contract. As regards the scope of data that can be processed on that basis, the principle of adequacy formulated in Article 5(1)(c) GDPR applies fully in this case.

#5.2.3 Legal Obligation

Data processing is permitted where this is ‘necessary for compliance with a legal obligation to which the controller is subject’ (Article 6(1)(c) GDPR).

The grounds under Article 6(1)(c) GDPR are independent of the other types of grounds listed in the GDPR, but these grounds are incomplete. For grounds for a legal obligation to be complete, it is important to be linked to the relevant national or EU law which gives rise to a specific legal obligation to which the controller is subject (as in the case of the grounds for a legitimate interest of the controller, which also require that interest to be identified).

A legal obligation can be cited as grounds where two conditions are fulfilled jointly: there must be a provision in law that places a legal obligation on the controller, and at the same time data processing must be necessary to perform that legal obligation.

The grounds for the legal obligation resemble the grounds specified in Article 6(1)(e) GDPR, which states that data processing is permitted when ‘processing is necessary for the performance of a task carried out in the public interest [public task] or in the exercise of official authority [official powers] vested in the controller’.

When considering the wording of a national or EU provision, the guidelines on this subject in Recital 45 GDPR have to be taken into consideration. The Regulation does not require a specific law for each individual processing. It is sufficient for a law to be a basis for several processing operations based on a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. The act of law does not have to break down a legal obligation into multiple data processing operations (collection, transmission, storage, transmission, enrichment, etc.) or define a specific catalogue of data that it is permitted to process. It is sufficient for the legal obligation to be described. This obligation cannot be performed without carrying out particular operations on personal data. The criterion of a logical link between the legal obligation and processing should, therefore, be applied.

The grounds for a legal obligation will apply not only to public authorities but also to any person who has a specific legal obligation which processing of specific personal data of a particular group is needed to perform, for example laws regulating obligations of road users.

#5.2.4 Protection of Vital Interests

Under Article 6(1)(d) GDPR, data processing is permitted where ‘necessary to protect the vital interests of the data subject or of another natural person’.

As the name suggests, and as provided for in Recital 46 GDPR, a data subject’s vital interests are those that have a major impact on a particular person’s life, such as the saving of life, health, or property (e.g., if somebody’s wallet is found in an office). This also applies in cases of disasters affecting a large number of people, for example epidemics or natural disasters.

Importantly, this is not solely a question of the personal data of a person in danger. To protect the vital interests of one individual, it is permitted to process the personal data of other persons.

On the grounds of and to protect vital interests, it is permitted to process ‘ordinary’ data, for example contact details and information about family and friend relationships.

It is permitted to process special categories of data (usually in matters concerning health) on the grounds of protection of vital interests only where the data subject is physically or legally incapable of giving consent’ (Article 9(2)(c) GDPR).

For example details concerning state of health of an accident victim can be processed if that person is unconscious or if it is a question of a child’s health and the child’s legal guardian is not present.

Recital 46 GDPR also states:

‘Processing of personal data based on the vital interest of another natural person should in principle take place only where the processing cannot be manifestly based on another legal basis’ – i.e. grounds specified in Art. 6(1) GDPR other than those discussed here. This is therefore ‘standby’ grounds for personal data processing.

#5.2.5 Tasks Carried out in the Public Interest or in the Exercise of Official Authority

Under Article 6(1)(e) GDPR, personal data processing is permitted when ‘necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’.

This relates to two different types of grounds for data processing, which are:

1. 1)performance of a task carried out in the public interest, and
2. 2)the exercise of official authority vested in the controller.

In both of these cases, both a public task and exercise of public authority have to be described in greater detail in the law, whether national or EU law, and therefore knowledge is required of specific legal grounds for a public task or official authority, and these specific legal grounds have to be cited.

A task carried out in the public interest means in particular public utility works such as supplying water, electricity, gas and heat for the population, maintaining roads and communication, providing education, healthcare, social welfare, etc.

Bodies entitled to cite grounds of performance of a public task are public authorities, and natural and legal persons as well, who have been given public tasks (such as running the Family Welfare Centre in a municipality).

As in the case of grounds being an exercise of public authority, public authorities and other bodies as well can cite these grounds if they have been given public authority powers.

#5.2.6 Legitimate Interest of a Controller or Third Party

The grounds of legitimate interest of a controller or third party as provided for in Article 6(1)(f) GDPR is one of the most useful types of grounds, and despite this is not fully appreciated by controllers so far. This is probably due to the wording and the need to find a balance between the interests of the controller or other entity on the one hand, and the interests of the data subject on the other.

To cite the grounds of legitimate interest effectively, both of the following requirements have to be fulfilled:

1. 1)processing has to be necessary for the performance of a specific purpose arising from legitimate interests of a controller or third party, and
2. 2)the interests or fundamental rights and freedoms of the data subject that require personal data protection do not override in the case in question the interests of a particular entity that requires processing of data of the individual. A balance must be found between these interests in particular in cases of processing of a child’s data. It should not be assumed automatically that the interest or rights of a child will be an obstacle to processing of their data in order to perform a legitimate interest of a different entity.

For data processing to be determined to be necessary, a situation has to arise in which a controller’s interest cannot be realised without processing specific data (i.e., data processing is a condition for realising that interest).

These interests must be legitimate in legal terms. The term ‘legal’ should not be considered to mean the same as the need to demonstrate a specific legal basis under some statute, because in such a case these grounds would overlap with the grounds provided for in Article 6(1) (c) GDPR. The established view is that a legitimate purpose for data processing is one that follows, for example, from the scope of business activity of a business, or pursuit of statutory goals by a foundation. This is therefore an interest that the organisation in question is authorised to pursue (it is not prohibited).

As regards the fundamental rights and freedoms of a data subject, this should be interpreted as rights and freedoms of every person under the EU or national legislature. Under Recital 69 GDPR, but also in line with the accountability principle, it is the controller who is responsible for demonstrating that the legitimate interests of an organisation (controller or third party) override the legitimate interests or fundamental rights and freedoms of the data subject.

According to Article 6(1) paragraph 2 GDPR, public authorities cannot cite legitimate interest to justify processing personal data for the performance of their duties. Authorities should seek grounds for processing among those provided for in Article 6(1)(c) and (e) GDPR. We believe that for ‘internal’ goals such as physical security, even authorities may rely on legitimate interest. Others invoke the relation between statutory goals and internal processes to legitimise data processing for internal purposes based on statutory goals. That, however, seems more like a prosthesis of a legal grounds and goes beyond the wording of art. Article 6(1) paragraph 2 GDPR.

The GDPR provides for quite a large number of situations in which the grounds for personal data processing are in fact the legitimate interest of a controller (see Recitals 47–49 GDPR). These include:

1. 1)prevention of fraud, for example personal data processing to identify suspicious payments;
2. 2)direct marketing; interestingly, Recital 47 does not specify that this relates to an organisation’s own direct marketing. This may mean that marketing of products of a different entity, for example affiliates in a capital group, is possible based on legitimate interest, but it needs to be borne in mind that for this purpose, for marketing in electronic form and by telephone (sending commercial information electronically or using telecommunications terminal devices) to be valid, the appropriate consent to communication under the Act on Electronic Services and the Telecommunications Law, and soon probably the planned e-privacy regulation should be obtained;
3. 3)data transmission within a capital group, i.e. ‘for internal administrative purposes, including the processing of clients’ or employees’ personal data’ (Recital 48 GDPR);
4. 4)cybersecurity, i.e. for ‘ensuring the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams(CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services’, for example ‘preventing unauthorised access to electronic communications networks and malicious code distribution and stopping “denial of service” attacks and damage to computer and electronic communication systems’ (Recital 49 GDPR);
5. 5)pursuit of claims.
6. Other practical examples can be included in the catalogue given above:
7. 6)keeping records of incoming and outgoing correspondence,
8. 7)keeping records of entry and exit of office premises,
9. 8)review of complaints by private entities,
10. 9)transfer of receivables.

According to supervisory bodies and experts, relying on legitimate interests should be preceded by a ‘balancing test’^, or a more exhaustive ‘legitimate interest analysis’. With the growth of data protection awareness, recourse to legitimate interest and therefore performing a balancing test becomes more and more common. For instance it can be very helpful to define proper direct marketing practices, which can then be coded by a particular business in a sustainable direct marketing policy or similar document.

#5.3 Choice of the Legal Basis for Processing

According to supervisory bodies a controller should choose only one legal basis for processing data if more than one is available.

Subsequent changing of a legal basis for processing during processing is, as a rule, not allowed. The reasoning behind that conclusion is, though, not straightforward. It seems that supervisory bodies are afraid of circumventing the law through juggling with legal basis for processing (e.g., moving from consent to legitimate interest in case consent is withdrawn) as well as of overcomplicating things for consumers (as if data protection was not overcomplicated for businesses and other organisations). However, such issues can be solved without such formal restrictions. Probably it would be better to say that if you are changing a legal basis for processing we will look closer at what it really means.

Anyway an organisation should choose their legal basis for processing wisely, bearing in mind that a mistake may lead to illegal processing, which is a major data protection ‘offence’.

The authors of this book are fans of relying on legitimate interest of a controller or third party as provided for in Article 6(1)(f) GDPR, considering it as one of the most useful types of grounds for personal data processing. Legitimate interest is not fully appreciated by controllers so far. This is probably due to the fact it is not ‘mechanical’, and it requires thinking, balancing interest, documenting and therefore it contains elements of knowledge, decision and personal responsibility because the need to find a balance between the interests of the controller or other entity on the one hand and the interests of the data subject on the other. Still ‘legitimate interest’ corresponds to ‘common sense, documented’, and in applying data protection relying on common sense is often inevitable.