Skip to main content
Home

Legal obligations compatibility condition

Contents

In detail

What is the legal obligations compatibility condition?

When you collect personal information, you usually know if a legal obligation does or may apply to you. Therefore, you specify such an obligation as part of your purposes. However, sometimes you may need to process personal information in response to a legal obligation that you didn’t originally expect. 

Annex 2 says:

“Legal obligations 

12. This condition is met where the processing is necessary for the purposes of complying with an obligation of the controller under an enactment, a rule of law or an order of a court or tribunal.”

We call this the ‘legal obligations compatibility condition’ (although this term is not used in the legislation itself). This compatible condition is available if it’s necessary for you to reuse personal information to comply with a legal obligation. For example, this might come from a duty or obligation to comply with:

  • another law;
  • a court order;
  • an instruction from a public body exercising its legal powers; or
  • a subsequent enactment.

How do we apply this compatibility condition?

To apply the legal obligations compatibility condition, you must:

  • intend to reuse personal information to comply with a legal obligation; and
  • ensure that reusing the personal information is necessary for this purpose.

In many cases, it is obvious from the legal obligation what personal information you need to reuse to comply with it. (For more on necessity, see 'How do we apply an annex 2 compatibility condition?'.) 

Remember, if you originally collected the personal information under the lawful basis of consent, you must consider whether it is reasonable to ask for consent for the new processing.

In any case, you must satisfy a lawful basis for reusing personal information in this way. Depending on the circumstances, if you need to reuse personal information for the purpose of complying with a legal obligation, then it’s likely you can rely on the legal obligation lawful basis. 

You must also have a special category condition if your reuse of the personal information involves special category data. You may find that the specific special category condition for legal claims or judicial acts is appropriate.

If you intend to reuse criminal offence data, you must comply with the requirements of article 10 of the UK GDPR.

Example

A company is subject to litigation by a former employee who has made allegations about its senior management. The former employee’s solicitor asks for copies of confidential personnel records belonging to these senior managers. The company initially refuses to share the personal information.

The solicitor obtains a court order instructing the company to disclose the records. The company releases copies to the solicitor, as doing so complies with a legal obligation. Therefore, this further processing is compatible with the original purpose.

Further reading – ICO guidance