Emergencies compatibility condition

In detail

• What is the emergencies compatibility condition?
• How do we apply the emergencies compatibility condition?

What is the emergencies compatibility condition?

You may need to deal with an emergency event or situation, and this may involve using people’s personal information. However, you may not have expected to need to use their information to respond to such an emergency when you originally collected it. Data protection law allows you to reuse personal information in ways that are necessary and proportionate to respond to an emergency.

Annex 2 says:

“Emergencies 

4. This condition is met where the processing is necessary for the purposes of responding to an emergency.

5. In paragraph 4, “emergency” has the same meaning as in Part 2 of the Civil Contingencies Act 2004.”

We call this the ‘emergencies compatibility condition’ (although this term is not used in the legislation itself). You can use this compatibility condition if the event or situation meets the definition of an emergency as set out in the Civil Contingencies Act 2004 (CCA 2004). If the circumstances don’t meet this definition, your reuse of personal information isn’t compatible under this condition. Instead, you need to consider a different compatible purpose. For example, if the situation relates to a matter of public security, it may meet the public security compatibility condition.

The definition of an emergency in part 2 of the CCA 2004 covers a wide range of circumstances, including:

• war or terrorism that threatens serious damage to the security of the UK;
• an event or situation that threatens serious damage to people’s welfare in the UK; and
• an event or situation that threatens serious damage to the UK environment. 

In other words, it can’t be minor or trivial. It’s likely that the event will imminently cause significant or severe harm or destruction. 

The emergency or the impact of the event doesn’t have to affect the whole of the UK – it may impact only a particular area. An event or situation abroad can also be a qualifying emergency if it threatens serious damage to the UK. Because many infrastructure systems are global and interconnected, you may need to use personal information to respond to an emergency event or situation outside the UK.

The CCA 2004 says an event or situation threatens serious damage to people’s welfare only if it involves, causes or might cause:

• illness, injury or loss of people’s lives;
• homelessness or damage to property;
• disruption of a supply of money, food, water, energy or fuel;
• disruption of a system of communication; or
• disruption of facilities for transport or services relating to health.

If a threat of serious damage to people’s welfare doesn’t involve any of these, the emergencies condition doesn’t apply. Similarly, if a type of event or situation that might threaten the environment is not listed in the CCA 2004, the emergencies condition doesn’t apply. The listed events or situations include: 

• contamination of land, water or air with biological, chemical or radioactive matter; and
• disruption or destruction of plant or animal life.

Examples of emergency situations where you may need to reuse personal information include large-scale events that threaten people’s lives (eg extreme weather events, pandemics and cyber-attacks on infrastructure). However, a smaller event that causes disruption can count. In either case, it doesn’t have to be a physical disaster. 
  
The emergencies compatibility condition only covers events that are in the scope of CCA 2004. It doesn’t cover situations where you need to reuse personal information to help someone who is experiencing a personal emergency (eg they’ve had a serious accident on your premises). However, this doesn’t mean you can’t reuse their personal information for that purpose. For example, in some cases, you may be able to rely on the vital interests compatibility condition if your reuse of personal information is necessary to protect someone’s life. For more information, see Vital interests compatibility condition.

How do we apply the emergencies compatibility condition?

To use the emergencies compatibility condition you must:

• intend to reuse the personal information in an event or situation that counts as an emergency; and
• be able to demonstrate that your reuse of the personal information is necessary for responding to the emergency.

You should be clear what location the emergency covers, as you may only need to reuse personal information about people who are in that area.

When you identify a situation as an emergency, you must decide if reusing people’s information is necessary to respond to that emergency.

We understand that emergency situations happen without warning and that you may need to make decisions about reuse quickly. But it’s unlikely to be time-consuming or difficult to determine if it’s necessary or proportionate to reuse personal information to respond to an emergency. In most cases, you are likely to be able to use the information for this purpose. 

However, you should include data protection in your contingency planning for emergencies. This helps avoid delay and uncertainty in these circumstances.

Remember, if you originally collected the personal information under the lawful basis of consent, you must consider whether it is reasonable to ask for consent for the new processing. In an emergency situation, it may not be practical to ask for consent. Therefore, in most cases, it’s likely that you can rely on recognised legitimate interest and its emergencies condition for this purpose. This is virtually identical to the annex 2 compatibility condition and is likely intended to complement it. 

However, this condition isn’t available if you are a public authority and the processing is part of your public tasks. Instead, as a public authority, you may find the public task lawful basis more appropriate in such cases.

If your reuse includes special category data, you must also identify an article 9 condition. If your reuse includes criminal offence data, you must also identify an article 10 condition.