Lawful processing

Question 1

What can be the basis of lawful processing in Article 6?

Answer 1

(a) Consent
(b) Performance of contract
(c) Compliance with legal obligation
(d) Vital interests of data subjects or natural persons
(e) Performance of a task carried out in the public interest or in the exercise of official authority
(f) Legitimate interests of the controller or third party; except where overridden by interests/fundamental rights and freedoms of data subject (does not apply to public authorities)

Question 2

What are the conditions for a valid consent?

Answer 2

Freely given 
Specific
Informed
Unambiguous indication of wish
(By statement or clear affirmative action)

Controller must be able to demonstrate that subject has consented
Right to withdraw without suffering detriment

Question 3

What special conditions apply in the case of a child’s consent?

Answer 3

Above 16 of age: Child can consent itself
Below 16 of age: Legal guardian must consent or authorise consent

Age can be set differently by MS

Question 4

What can be the basis of lawful processing in Article 9?

Answer 4

(a) Explicit consent
(b) Obligations and rights in the field of employment and social security and social protection law
(c) Vital interests of data subjects or other persons where they are physically or legally incapable of giving consent
(d) Legitimate activities by a foundation, association or non-profit bodies with a political, philosophical, religious or trade union aim
(e) Data are manifestly made public by subject
(f) Establishment, exercise or defence of legal claims
(g) Substantial public interest
(h) Preventive or occupational medicine, assessment of working capacity, medical diagnosis, provision of health or social care or treatment or management of health or social care systems and services
(i) Public interest in the area of public health
(j) Archiving purposes in public interest, scientific, historical research, statistical purposes

Question 5

Why are there two different categories of lawful grounds?

Answer 5

Article 9 covers sensitive data; data which should be protected to a higher degree than normal data, since it entails a higher risk of discrimination and violations of the right to privacy and protection of personal data.

Article 9 is, contrary to Article 6, formulated as a general prohibition for processing with a following list of exceptions to the prohibition.

Article 9 requires inter alia an “explicit consent” and does not permit processing due to necessity of performance of a contract.