Lawful Bases for Processing Data Flashcards
What are the lawful bases for processing data as outlined in the Kenya Data Protection Act DPA 2019?
- Consent of the data subject
- Contractual Necessity
- Compliance with legal obligations
- Vital interests
- Public interest tasks or exercising official authority
- Legitimate Interests
- Historical, statistical, journalistic, literary, art, or scientific research
- National security or public interest
What is the first legal basis for data processing?
Consent of the data subject:
The data subject has given clear consent for their personal data to be processed for a specific purpose.
What is the second legal basis for data processing?
Contractual Necessity:
Processing is necessary for the performance of a contract to which the data subject is a party.
What is the third legal basis for data processing?
Compliance with Legal Obligations:
Processing is necessary for compliance with a legal obligation to which the data controller is subject.
What is the fourth legal basis for data processing?
Protecting Vital Interests:
Processing is necessary to protect the vital interests of the data subject or another individual.
What is the fifth legal basis for data processing?
Public interest tasks or exercising official authority:
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
What is the sixth legal basis for data processing?
Legitimate Interests:
Processing is necessary for the purposes of legitimate interests pursued by the data controller or a third party,
except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
What is the seventh legal basis for data processing?
Journalistic, Historical, Statistical, Literary, Art, or Research:
This data must be processed in accordance with relevant ethics and guidelines of the specific feilds.
What is the eighth legal basis for data processing?
National security or public interest: The Act provides exemptions for processing in these areas, but emphasizes the importance of data protection principles
What does “consent” require to be valid?
Consent must be
freely given,
specific,
Informed, and
unambiguous, typically through an affirmative action.
How can a data subject withdraw consent?
A data subject can withdraw consent at any time, and it must be as easy to withdraw consent as it is to give it.
What is the significance of “contractual necessity”?
It allows processing when it is essential for fulfilling contractual obligations to the data subject.
What does “legal obligation” entail in data processing?
It allows processing when it is necessary to comply with a legal requirement imposed on the data controller.
What does “vital interests” refer to in the context of data processing?
It refers to processing that is necessary to protect someone’s life, typically in emergency situations.
What is the role of “public task” in legal data processing?
It allows processing when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
What must be demonstrated when relying on “legitimate interests”?
A balancing test must be conducted to ensure that the legitimate interests do not infringe on the rights and freedoms of the data subject.
Can legitimate interests be used for direct marketing?
Yes, but the data subject’s interests and rights must be considered, and they must be given the opportunity to object.
However, the data subject has the absolute right to object to such processing, and if they do, the processing must be restricted pending verification
What is the importance of documenting the legal basis for processing?
It ensures accountability and compliance with data protection principles, allowing data subjects to understand the basis for processing.
What is the lawful basis for processing personal data?
Personal data must be processed based on one or more lawful bases as defined in the Data Protection Act.
What is the first lawful basis for processing data?
Consent: The data subject has given clear consent for their personal data to be processed for a specific purpose.
What is the second lawful basis for processing data?
Contractual Necessity: Processing is necessary for the performance of a contract to which the data subject is a party.
What is the third lawful basis for processing data?
Legal Obligation: Processing is necessary for compliance with a legal obligation to which the data controller is subject.
What is the fourth lawful basis for processing data?
Vital Interests: Processing is necessary to protect the vital interests of the data subject or another individual.
What is the fifth lawful basis for processing data?
Public Task: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
