Navigating GDPR Lawful Bases: A Guide for Data Processing

Since its implementation in May 2018, the General Data Protection Regulation (GDPR) has significantly transformed the way organisations within the European Union (EU) and those dealing with EU citizens approach data privacy. One of the core concepts that govern how data is processed under GDPR is the notion of lawful bases. Lawful bases are the legitimate grounds upon which organisations can process personal data, and without these, processing data would be considered unlawful.

Understanding and properly navigating GDPR’s lawful bases for processing data is essential for businesses, governmental bodies, and non-profit organisations to ensure compliance. Failure to comply can result in hefty fines, brand damage, and a loss of consumer trust. This comprehensive guide will delve into the six lawful bases for data processing under the GDPR, offering insights into how organisations can apply them correctly and remain compliant.

The Importance of Lawful Bases Under GDPR

GDPR is founded on the principle of accountability, requiring organisations to be responsible for their data processing activities. As part of this accountability, they must clearly identify the lawful basis that justifies each processing activity they undertake. There are six lawful bases provided by GDPR, and each one represents a unique legal justification for processing personal data. These include:

1. Consent
2. Contract
3. Legal Obligation
4. Vital Interests
5. Public Task
6. Legitimate Interests

Each lawful basis has specific applications, implications, and requirements for organisations. Choosing the appropriate lawful basis is crucial as it influences how organisations collect, store, and share data, as well as what rights individuals (data subjects) can exercise over their data. Importantly, organisations must document their chosen lawful basis and demonstrate how it applies to the data processing activity in question.

Consent: The Most Widely Misunderstood Lawful Basis

Consent is perhaps the most well-known lawful basis but also the most misunderstood. Under GDPR, consent must be freely given, specific, informed, and unambiguous. This means that organisations cannot assume consent through pre-ticked boxes or silence. The data subject must take a positive action to indicate their consent, and organisations need to ensure that they provide enough information for individuals to understand what they are consenting to.

Key Considerations for Obtaining Consent

• Granular Consent: When seeking consent, organisations should allow individuals to choose different options for various types of processing. For example, someone might consent to receive marketing emails but not to have their data shared with third parties.
• Revocation of Consent: Data subjects must be able to withdraw their consent as easily as they gave it. Organisations should clearly explain how to do this, and once consent is withdrawn, the processing must stop.
• Record-Keeping: It is essential for organisations to maintain records that demonstrate when and how consent was obtained. This record-keeping is crucial for proving compliance in the event of an audit or investigation.

Common Pitfalls with Consent

One common issue with consent is that organisations often rely on it unnecessarily. While consent is valid in many scenarios, other lawful bases may be more appropriate, particularly where there is an imbalance of power between the organisation and the individual, such as in an employer-employee relationship. In these cases, consent may not be deemed to be freely given, as the individual might feel compelled to provide it.

Contract: A Lawful Basis Rooted in Necessity

When processing is necessary for the performance of a contract with the data subject, or to take steps at the request of the data subject before entering into a contract, the Contract lawful basis applies. This is commonly used when processing personal data is required to fulfil a service or provide a product that the individual has requested.

When to Use the Contract Lawful Basis

The contractual lawful basis is appropriate when:

• The processing is directly related to the delivery of a product or service.
• There is a contractual relationship between the organisation and the data subject, and the processing is necessary to fulfil that contract.
• Pre-contractual steps, such as responding to a request for a quote, require the use of personal data.

However, it is crucial to understand that simply having a contract does not automatically make this lawful basis applicable. The key factor is necessity; the processing must be essential to the contract’s performance.

Legal Obligation: Ensuring Compliance with the Law

The Legal Obligation lawful basis applies when the organisation needs to process personal data to comply with a legal obligation. This does not include contractual obligations, but rather legal requirements that an organisation is subject to, such as tax reporting, employment law, or compliance with financial regulations.

Applications of Legal Obligation

This lawful basis is often used in sectors where regulatory requirements are prevalent. For instance:

• Employment law: Employers must process employee data to fulfil legal obligations related to payroll, tax contributions, and workplace safety.
• Financial services: Organisations may need to process personal data to comply with anti-money laundering regulations or reporting obligations to financial authorities.
• Health and safety: Businesses must collect and report certain types of personal data, such as accident reports, to comply with health and safety regulations.

One of the key points to note with the Legal Obligation lawful basis is that it only applies when a specific legal obligation is imposed on the organisation. It cannot be used as a blanket justification for all data processing activities.

Vital Interests: Protecting Life and Well-Being

The Vital Interests lawful basis is narrowly defined and applies in situations where processing is necessary to protect someone’s life or well-being. This lawful basis is typically used in emergencies, such as when processing personal data is necessary for medical reasons and the data subject is unable to provide consent.

Use Cases for Vital Interests

While this lawful basis may seem straightforward, it is only applicable in rare and extreme circumstances. Some examples include:

• Medical emergencies: If an individual is unconscious and personal data must be processed to administer medical treatment.
• Humanitarian emergencies: In the event of a natural disaster or major accident, processing personal data may be necessary to protect people from harm.

In practice, the Vital Interests lawful basis is seldom used by most organisations, but it is a crucial mechanism in the rare cases where it applies.

Public Task: For Public Authorities and Their Mandates

The Public Task lawful basis applies when processing personal data is necessary for an organisation to perform a task that is carried out in the public interest or to exercise official authority vested in the organisation. This lawful basis is primarily used by governmental bodies, local authorities, and organisations carrying out public duties.

When to Use the Public Task Lawful Basis

This lawful basis is appropriate for:

• Public sector organisations: Schools, councils, and government departments that process personal data as part of their official functions.
• Non-governmental organisations: Certain NGOs or private organisations might also rely on this lawful basis if they are carrying out activities on behalf of a public authority.

However, private companies that do not have a public mandate will generally not be able to use this lawful basis.

Legitimate Interests: The Flexible Lawful Basis

Legitimate Interests is the most flexible and, arguably, the most complex of the lawful bases. It allows organisations to process personal data where it is necessary for their legitimate interests, provided that those interests are not overridden by the rights and interests of the data subject.

How to Use the Legitimate Interests Lawful Basis

To rely on this lawful basis, organisations must carry out a Legitimate Interests Assessment (LIA), which is a three-part test:

1. Purpose test: Is there a legitimate interest behind the processing? This could be a business interest, a societal benefit, or a third-party interest.
2. Necessity test: Is the processing necessary to achieve that purpose? Organisations must determine if the same objective could be achieved in a less intrusive manner.
3. Balancing test: Does the processing override the rights and freedoms of the data subject? If the data subject’s rights outweigh the organisation’s interests, the processing cannot be justified under this lawful basis.

Common Applications of Legitimate Interests

• Marketing: Organisations often rely on legitimate interests to send marketing communications to existing customers, provided that the marketing is relevant and expected.
• Fraud prevention: Data processing activities that help detect or prevent fraud can be justified under legitimate interests.
• Security: Processing personal data to ensure the security of systems, networks, or physical spaces may be a legitimate interest.

Challenges with Legitimate Interests

One of the main challenges of using legitimate interests is that it requires a careful balancing act. Organisations must be transparent about their legitimate interests and provide data subjects with information on how their rights are being safeguarded. Data subjects also have the right to object to the processing of their data under this lawful basis, which further complicates its use.

Documenting and Demonstrating Compliance

Under GDPR’s accountability principle, organisations are required to demonstrate their compliance with the regulation, including their lawful bases for processing. This involves maintaining records that detail the lawful basis relied upon for each processing activity and explaining how the lawful basis applies.

What to Include in a Lawful Basis Record

For each processing activity, organisations should document:

• The lawful basis relied upon: Clearly state which of the six lawful bases applies to the processing activity.
• The rationale for choosing the lawful basis: Explain why the chosen lawful basis is appropriate for the specific data processing.
• How the data subject is informed: Detail how the data subject is made aware of the lawful basis, typically through a privacy notice.
• Any associated rights: Explain which rights the data subject can exercise, such as the right to withdraw consent or the right to object to processing.

These records serve as proof of compliance and are essential for demonstrating accountability to data protection authorities.

Communicating Lawful Bases to Data Subjects

A key part of GDPR compliance is transparency. Organisations must inform individuals of the lawful basis they are relying upon when collecting and processing their personal data. This information is typically provided in privacy notices or terms of service.

Privacy Notices

Privacy notices should include:

• The lawful basis: Specify the lawful basis being relied upon for each type of processing activity.
• Data subject rights: Inform individuals of their rights in relation to the lawful basis being used, such as the right to withdraw consent or the right to object to processing under legitimate interests.
• Other relevant information: This includes how personal data will be used, who it will be shared with, and how long it will be retained.

Organisations should ensure that their privacy notices are easy to understand and accessible to all users. Legal jargon should be avoided, and the information should be presented in clear, concise language.

Choosing the Right Lawful Basis: A Strategic Decision

Selecting the appropriate lawful basis for each processing activity is not just a legal necessity—it’s also a strategic decision that affects how organisations interact with their customers, employees, and partners. Relying on the wrong lawful basis can lead to non-compliance, customer dissatisfaction, and legal challenges.

Key Factors to Consider When Choosing a Lawful Basis

• The nature of the data: Sensitive data, such as health information or biometric data, may require more stringent legal bases like consent or legal obligation.
• The relationship with the data subject: A pre-existing relationship (such as a customer relationship) may make contract or legitimate interests more appropriate than consent.
• Data subject expectations: If data subjects would not reasonably expect their data to be processed for a particular purpose, it may be necessary to seek explicit consent.
• Risk of harm: Consider the potential impact of the processing on the rights and freedoms of data subjects. If the risks are high, consent or legitimate interests may be less appropriate than other lawful bases.

By carefully selecting and documenting the lawful basis for each processing activity, organisations can mitigate the risk of non-compliance and ensure they are upholding the rights and freedoms of individuals.

Conclusion

Navigating GDPR’s lawful bases for data processing is a critical aspect of compliance that requires careful consideration and documentation. Each lawful basis has its own unique requirements, and organisations must ensure they are applying the correct basis for each processing activity. From obtaining valid consent to assessing legitimate interests, the choice of lawful basis affects not only compliance but also the organisation’s relationship with data subjects.

In summary, understanding and correctly applying the GDPR’s lawful bases is key to responsible data management. By aligning their data processing activities with the appropriate lawful bases, organisations can maintain compliance, build trust with their customers, and avoid the significant penalties that can arise from non-compliance.