The public task is applicable when personal data processing is required in the exercise of official authority or when the law allows it in the public interest.
It is most relevant to public authorities, but it can apply to any organisation that exercises official authority or carries out tasks in the public interest.
A specific statutory power is not required to process personal data, but the underlying task, function or power must have a clear basis in law.
The processing must be necessary. If the task can be reasonably perform ed or the powers exercised in a less intrusive way, this lawful basis does not apply.
As always, the action should be documented for justification about the why and how the personal data was gathered and processed and, if relevant, the individuals should be informed.
What are public interests?
As stated in Article 6(1)(e), “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”
When is it applied?
Its application is mainly driven by law. When the law lays down a specific task in the public interest or when an official authority exercise is required, such as a public body’s tasks, functions, duties or powers. This covers public functions and powers that are set out in law.
Need Help with GDPR?
Get in touch with us if you need help on the subject.