GDPR: Processing personal data to comply with legal obligations

Čo v článku nájdete:

The legal basis of compliance with a legal obligation under Article 6(1)(c) GDPR provides that processing is lawful where, and to the extent that, it is necessary for compliance with a legal obligation.

Legal obligations when processing personal data

Legal obligations are specified by individual legal regulations. If a law or subordinate regulation requires a business to process personal data, the entity must process that personal data.

Some laws set out personal-data processing obligations precisely, including which personal data must be obtained and the scope of processing.

For example, accounting and payroll and HR performed under special regulations—the Accounting Act, the Social Insurance Act and similar legislation—require personal data to be processed.

When is it not a legal obligation but a legitimate interest?

Businesses and processors should also recognise situations in which the legal basis of compliance with a legal obligation cannot be used. These are usually situations where the law does not directly require the controller to process personal data, but merely permits such processing.

Practical examples

A business with employees is required by the Labour Code to keep records of working time. By keeping attendance records, the employer processes personal data in connection with recording working time as part of its legal obligation.

An employer is also entitled to introduce control mechanisms and may check matters and compliance with regulations (occupational health and safety, and so on). The employer is entitled to—and may have a legitimate interest in—introducing such checks, but they are not a legal obligation.

Sometimes determining the legal basis is more difficult. The legal basis must be selected so that it is properly and unambiguously justified in relation to the purpose of processing. Selecting the wrong legal basis may itself breach the provisions of the GDPR Regulation.