Re: Lawfulness of processing

Dear Axel, dear Harsh, dear all,

A higher level category 'justification for processing', of which 
'consent' is one subcategory, makes sense.

However, I really think we should focus on the default list of Art. 6 
GDPR first, which is:

  * Consent - Art.6 para. 1 (a)
  * Contract - Art.6 para. 1 (b)
      o Processing is necessary for the performance of a contract with
        the data subject
  * Legal obligation - Art.6 para. 1 (c)
      o This means a law allows or even requires proccessing for compliance
      o This can e.g. entail that an organisation must process certain
        personal data to fulfil its legal duties. An example is the
        obligation to store billing data for a longer time for tax
        authorities. Another example would be the need to comply with
        justified law enforcement access inquiries.
  * Vital interests of the data subject - Art.6 para. 1 (d)
      o Processing is necessary to protect vital interests of data
        subject - the classic example is the medical emergency
  * Task carried out in the public interest _or_ in the exercise of
    official authority vested in the controller -
    Art.6 para. 1 (e)
      o This entails the processing that e.g. a governmental institution
        needs to do to perform its tasks. An example for public interest
        if e.g. tax authorities pursuing cases of money laundering
        (fighting crime is a public interest). An example for the latter
        is e.g. a registry office needing your information like name and
        adress to register where you live and to give out passports.
  * Legitimate interest - Art.6 para. 1 (f)
      o Processing necessary for the purposes of the legitimate
        interests pursued by the controller or by a third party, _except
        where such interests are overridden by the interests or
        fundamental rights and freedoms of the data subject_.

I see that Harsh has introduced more aspects in his list. My assumption 
is that this is caused by the fact that the GDPR foresees some specific 
rules and exemptions and he also looked at the justifications mentioned 
for sensitive data, too. However, I think we should try to differentiate 
to maintain a clearer picture of when which legal basis can apply.

Regarding the 'specifics' and exemptions, we should have in mind that:

  * public authorities cannot refer to the justification 'legitimate
    interest' for the performance of their tasks
  * the EU or EU Member States can specify the justifications 'Legal
    obligation' and 'Task carried out in the public interest or in the
    exercise of official authority vested in the controller'.
      o These specifications must fulfill some minimum requirements
        regulated in the GDPR (Art. 6 para. 3 (a) +(b)).
      o An example for such a specification in national law could e.g.
        be employment law.
  * a controller can process data for further purposes, as long as those
    are compatible with the original purpose(s).
      o This is actually _not another legal basis_! Rather, it is in
        this case assumed that the legal ground of the original
        processing extends to the new purposes
      o Compatible purpose is bound to specific requirements, which can
        be tricky for a controller to document properly (Art. 6 para. 4)

If we want to address sensitive data too (Art. 9  GDPR), we need an 
additional list of justifications applicable for this type of personal 
data.

  * This is because the justifications for the processing of senstivie
    data are partially different, are made much more specific and often
    have in their individual GDPR provisions very strict preconditions
    that must be fulfilled. Only the following justifications are possible:
      o _Explicit_ consent
      o Union or Member State _law____or____valid____collective
        agreement_ only when:
          + processing  is  necessary  for
              # carrying out the obligations and exercising specific
                rights of the controller or of the data subject
          + AND the law or collective agreement provides for appropriate
            safeguards and concerns the field of:
              # employment law
              # social security law
              # social protection law
      o Vital interests
      o Legitimate activities with appropriate safeguards by:
          + a  foundation, association or any other not-for-profit body
            with a political, philosophical, religious or trade union aim
              # This data can only concern members or former members of
                these bodies or persons, who have regular contact with
                it in connection with its purposes
              # Data is not allowed to be disclosed outside without data
                subject consent
      o Data already made manifestly public by data subject
      o Establishment, exercise or defence of legal claims or whenever
        courts are acting in their judicial capacity
      o Substantial public interest, on the basis of Union or Member
        State law
      o A specific medical justifications with preconditions mentioned
        in Art. 9 para 2 (h), such as purposes of preventive or
        occupational  medicine
          + Here, the GDPR especially highlights the importance of
            professional secrecy, see Art. 9 para. 3 GDPR
      o Public  interest in the area of public health
      o Archiving purposes in the public interest, scientific or
        historical research purposes or statistical  purposes (also
        certain with preconditions)
          + Here, the GDPR also imposes certain preconditions to be met,
            such as the implementation of safeguards, see Art. 89 para.
            1 GDPR.
          + Moreover, EU Member States are allowed to regulate specifics
            and derogations in their national laws again.

Please note that all these justifications/legal bases for sensitive data 
can be addressed by the EU Member States in national laws in order to 
maintain or introduce further  conditions, including limitations, with 
regard to the processing of genetic data, biometric data or data 
concerning health.
Also noticeable is that the justification of 'legitimate interest' is 
NOT possible when sensitive data are concerned.

Oof, that was quite a lot of info at once - and hopefully, not too 
confusing. :-D

Just my input to the processing justifications possible when personal 
data are concerned. I am curious to hear your own thoughts on it. But 
for now, I wish everyone a great weekend! :)

Greetings,

Eva

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein
Eva Schlehahn, uld67@datenschutzzentrum.de
Holstenstraße 98, 24103 Kiel, Tel. +49 431 988-1204, Fax -1223
mail@datenschutzzentrum.de - https://www.datenschutzzentrum.de/

Informationen über die Verarbeitung der personenbezogenen Daten durch
die Landesbeauftragte für Datenschutz und zur verschlüsselten
E-Mail-Kommunikation: https://datenschutzzentrum.de/datenschutzerklaerung/

Am 17.10.2018 um 17:58 schrieb Harshvardhan J. Pandit:
> Hi Axel, Sabrina.
> I agree that we should also have a taxonomy of "legal basis" for 
> processing.
>
> From the text of GDPR Sabrina shared earlier, I have the following 
> legal basis listed in GDPRtEXT:
> * Contract with Data Subject
> * Exempted by National Law
> * Employment Law
> * Given Consent
> * Historic, Statistical, or Scientific Purposes
> * Legal claims
> * Legal obligation
> * Legitimate Interest
> * Made public by Data Subject
> * Medical, Diagnostic, or Treatement
> * Not for Profit Org.
> * Public Interest
> * Purpose of New Processing
> * Vital Interest
>
> I propose we start with this (and the text from GDPR) as our starting 
> point for discussion.
>
> Best,
> Harsh
>
> On 17/10/18 8:35 AM, Axel Polleres wrote:
>> Dear all,
>>
>> I agree that we would need then not only to talk about consent but in 
>> general a categorisation or "taxonomy" of "justification for 
>> processing" or alike (using these as top-level categories), right?
>>
>> best regards,
>> Axel
>> -- 
>> Prof. Dr. Axel Polleres
>> Institute for Information Business, WU Vienna
>> url: http://www.polleres.net/  twitter: @AxelPolleres
>>
>>> On 17.10.2018, at 17:19, Sabrina Kirrane <sabrina.kirrane@wu.ac.at 
>>> <mailto:sabrina.kirrane@wu.ac.at>> wrote:
>>>
>>> Hi Axel & all,
>>>
>>> As a followup to Rigo's comment yesterday on other lawful means of
>>> processing, here is the relevant text from the GDPR:
>>>
>>> 1.Processing shall be lawful only if and to the extent that at least 
>>> one
>>> of the following applies:
>>>
>>> (a) the data subject has given consent to the processing of his or her
>>> personal data for one or more specific purposes;
>>>
>>> (b) processing is necessary for the performance of a contract to which
>>> the data subject is party or in order to take steps at the request of
>>> the data subject prior to entering into a contract;
>>>
>>> (c) processing is necessary for compliance with a legal obligation to
>>> which the controller is subject;
>>>
>>> (d) processing is necessary in order to protect the vital interests of
>>> the data subject or of another natural person;
>>>
>>> (e) processing is necessary for the performance of a task carried 
>>> out in
>>> the public interest or in the exercise of official authority vested in
>>> the controller;
>>>
>>> (f) processing is necessary for the purposes of the legitimate 
>>> interests
>>> pursued by the controller or by a third party, except where such
>>> interests are overridden by the interests or fundamental rights and
>>> freedoms of the data subject which require protection of personal data,
>>> in particular where the data subject is a child.
>>>
>>> Point (f) of the first subparagraph shall not apply to processing
>>> carried out by public authorities in the performance of their tasks.
>>>
>>> Best Regards,
>>> Sabrina
>>>
>>> -- 
>>> Postdoctoral researcher,
>>> Institute for Information Business
>>> Vienna University of Economics and Business
>>> Tel: +43-1-31336-4494
>>> E-mail: sabrina.kirrane [at] wu.ac.at <http://wu.ac.at>
>>> Homepage: www.sabrinakirrane.com <http://www.sabrinakirrane.com>
>>
>

Received on Friday, 19 October 2018 14:33:36 UTC