Legitimate interests as a justification for processing personal data

The Data Protection Bill, which is wending its way through Parliament, is intended to supplement the General Data Protection Regulation (GDPR), in particular where the GDPR has derogated matters to EU Member States. It also intends to incorporate the GDPR into UK law post-Brexit.

One of the more worrisome of the GDPR’s provisions is the veto on public authorities relying on their legitimate interests to justify processing personal data “in the performance of their tasks”. The Data Protection Bill defined a public authority for this purpose as any body within the ambit of the Freedom of Information Act. By that definition, the veto applies to universities and colleges.

The extent of the veto was the subject matter of some speculation, but a reasonable conclusion was that it only related to public authorities processing personal data in discharging their public functions and not otherwise. In the absence of a definition of “tasks”, there was nevertheless some anxiety that fundraising and alumni-relations activities would be severely constrained if institutions could not rely on legitimate interests and instead had to seek consent to process personal data for those purposes.

An amendment to the Data Protection Bill was agreed in December which provides that legitimate interests cannot be used to justify processing of personal data “when performing a task carried out in the public interest or in the exercise of official authority vested in it” (i.e. in the public authority/body). Consequently, processing personal data in relation to the private tasks of an institution will be capable of justification on the legitimate-interest ground. One would assume that fundraising and alumni relations fell into the category of private tasks.

It does however beg the question of what would be regarded as a task carried out in the public interest or in the exercise of official authority. Teaching is likely to fall into the latter category and some types of research. The debate on the amendment recognised the need for further guidance and a hope was expressed that the Information Commissioner would soon provide it. We all share that hope.

Comments - No comments posted yet.

Leave a Comment

 


Please add 7 and 6 and type the answer here: