Field of law
Data protection
Every processing operation needs a legal basis under Art. 6(1) GDPR, and the choice decides more than admissibility. Withdrawal, objection, the information duties and the question whether the purpose can still be changed later all hang on it. What follows is the continuing upkeep of that state, and it comes easier the more carefully the groundwork was done.
The choice of legal basis decides more than admissibility
Whether a processing operation is admissible is treated as the one question that comes first and is then settled. Art. 6(1) GDPR requires one of six conditions, and which one it becomes has effects beyond admissibility.
Six bases and what follows from them
Art. 6(1)(a) GDPR. Withdrawable at any time under Art. 7(3) GDPR, and withdrawal has to be as easy as giving consent. That right has to be pointed out under Art. 13(2)(c) GDPR. A later change of purpose cannot rest on the compatibility assessment in Art. 6(4) GDPR, because the provision expressly leaves consent out.
Art. 6(1)(b) GDPR. Covered is what is necessary for performance of the contract, together with pre-contractual steps taken at the data subject’s request. Neither withdrawal nor objection, but a narrow boundary. What the contract does not need is not covered by it.
Art. 6(1)(c) GDPR. The obligation has to bind the controller, and its legal basis lies under Art. 6(3) GDPR in Union or Member State law. No objection. The retention period follows here from the provision itself and not from a balancing exercise.
Art. 6(1)(d) GDPR. Covered are the vital interests of the data subject or of another natural person, that is, life and limb. Neither withdrawal nor objection. The basis stays reserved for the exceptional situation. It does not replace a consent that could have been obtained beforehand.
Art. 6(1)(e) GDPR. The load-bearing basis for a public body, because point (f) is unavailable to it. What is required is a task in the public interest or in the exercise of official authority. Its legal basis lies under Art. 6(3) GDPR in Union or Member State law, where Art. 6(2) GDPR permits more specific provisions. The German state data protection acts and sector legislation make use of that. Right to object under Art. 21(1) GDPR.
Art. 6(1)(f) GDPR. Requires a balancing exercise, and that is to be documented. Under Art. 21(1) GDPR there is a right to object on grounds relating to the data subject’s particular situation. For public authorities performing their tasks the basis is unavailable under Art. 6(1) subparagraph 2 GDPR.
The effort lies in implementation
What remains to be done after the admissibility assessment is regularly underestimated. Implementing data protection measures calls for planning, pragmatism, commitment and continuous monitoring. Without those, mistakes creep into day-to-day work.
Data protection therefore has two facets. The first is getting the groundwork right, that is, the legal basis, the purpose and the scope of a processing operation. The second is keeping that state in good order over the years. Work carefully at the outset and the upkeep comes easier, because every question after that meets a documented decision rather than a gap.
Walkthrough of a workplace
An office like any other? Perhaps not quite. Click into the picture to find the breaches.
0 von 7 Verstößen gefunden.
Neun Stellen im Raum sind anklickbar. An sieben ist etwas zu beanstanden, an zwei nicht.
Herzlichen Glückwunsch – alles gefunden!
Practical questions on this
Incidents and requests
Access requests
An access request needs no reasons, and the motives behind it are in principle irrelevant.
Data protection and security incidents
A personal data breach leaves 72 hours.
The supervisory authority is asking
The scope of the reply follows from the reason the letter gives, not from the length of the questionnaire.
Legal basis and admissibility
We are planning something
Data protection belongs in a new project from the outset and not in the acceptance test.
Automated individual decisions
Pre-selection is not a preliminary stage of the decision where the selection follows it to a significant degree.
Special categories of data
Art. 9(1) GDPR prohibits the processing, and a permission under paragraph 2 sits alongside the legal basis in Art. 6 GDPR rather than replacing it.
Transfer impact assessment
The regulation does not know the term transfer impact assessment.
Data protection impact assessment
An impact assessment under Art. 35 GDPR is not a formality at the end of a project.
Contracts and controllership
Reviewing processing agreements
Whether processing on behalf exists at all is decided by purposes and means, not by the type of contract.
Joint controllership
Every company in a group is a controller in its own right.
Works agreements as a legal basis
Co-determination under section 87(1) no. 6 BetrVG decides whether the works council has a say.
Ongoing duties and records
Record of processing activities
The difficulty with a record of processing activities usually lies not in creating it for the first time but in keeping it up to date.
Information duties
The duty to inform arises with the collection of personal data and does not presuppose a contractual relationship.
Consent forms
Consent is one of six legal bases and the only one that can lapse at any time.
Retention and erasure
Erasure duties do not depend on a request for erasure.
Systems in use
Microsoft 365
Whether Microsoft 365 may be used has long been settled in most organisations.
HR management systems
In data protection terms an HR management system is only as good as its access model.
Video surveillance
The yardstick for private video surveillance is Art. 6(1)(f) GDPR and not section 4 BDSG.
Cookies and tracking
Sec. 25(1) TDDDG covers access to terminal equipment and applies regardless of whether personal data arise in the course of it.
Sector-specific requirements
Related topics
Microsoft 365 Copilot
Under the Court of Justice, a provision adopted on the basis of Art. 88(1) GDPR may not merely repeat the conditions in Art. 6 GDPR.
Technical and organisational measures
Art. 32 GDPR requires a level of security appropriate to the risk and names criteria rather than a list.
ChatGPT
The body that sets the task decides on purpose and means and is therefore the controller under Art. 4(7) GDPR, even where the account is private.
SOC and SIEM
A system for evaluating security events processes large volumes of data about the conduct of staff, as a side effect of its purpose.
AI and works council participation
For section 87(1) no. 6 BetrVG the objective capacity to monitor suffices, provided the data can be attributed to individual employees.
AI governance
The roles are not free to allocate, because several provisions name their own addressee.
Claude
The purpose set at introduction limits every later use under Art. 5(1)(b) GDPR, and any extension has to be measured against Art. 6(4) GDPR.
Using AI in line with data protection law
Training and use are two processing operations, each with a legal basis of its own.
Transcription and meeting assistants
Recording the non-publicly spoken word is a criminal offence under section 201(1) no. 1 of the German Criminal Code where it is unauthorised, and that is a question alongside the legal basis.
Frequently asked questions
Is consent not always sufficient?
It is the most demanding of the six bases and not the safest. Under Art. 7(3) GDPR it may be withdrawn at any time, and withdrawal has to be as easy as giving it. On top of that, under Art. 6(4) GDPR the compatibility assessment for a later change of purpose is unavailable precisely where the processing rests on consent.
Can we change the legal basis later?
Not for the same processing operation. The basis is settled before the processing and is a subject of the information under Art. 13(1)(c) GDPR. Switching after a withdrawal or an objection would strip the right in question of its effect. For further processing for another purpose, the separate yardstick of Art. 6(4) GDPR applies.
We are a public authority. What changes?
Legitimate interests are unavailable. Under Art. 6(1) subparagraph 2 GDPR, point (f) does not apply to processing carried out by public authorities in the performance of their tasks. What remains are chiefly points (c) and (e), whose legal basis under Art. 6(3) GDPR must lie in Union or Member State law.
Is it enough to settle the measures once?
No. Art. 24(1) sentence 2 GDPR requires the measures to be reviewed and updated where necessary. The demonstration under Art. 5(2) GDPR relates to the state of affairs at the time of examination and not at the time of introduction.
Get in touch!
Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!
Contact usAlternatively you can request a call back.