Lawfulness of processing
Processing of personal data shall be undertaken ‘lawfully’. To show the processing is being undertaking lawfully one of the following conditions should apply (unless an exemption applies):
- You have given consent to the processing of your personal data for one or more specific purposes; (for example a university retaining personal data for alumni purposes)
- Processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. (For example if you purchase goods from an online shop to be delivered then the shop will need to process your personal details to allow them to perform the contract and deliver the goods to you)
- Processing is necessary for compliance with a legal obligation to which the council is subject. (For example processing staff personal data to comply with our legal obligation to disclose employee salary details to HMRC)
- Processing is necessary to protect your vital interests or the vital interests of another natural person. (For example if an individual is admitted to A & E following a road accident, then the disclosure to the hospital of the individuals medical history may be necessary in order to protect his/her vital interests)
- Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the council (this includes most of the council's functions which comes from various pieces of legislation); and
- Processing is necessary for the purposes of the legitimate interests. Public authorities, such as the council can only rely on legitimate interests if they are processing for a legitimate reason other than performing their tasks as a public authority.