Public security compatibility condition

In detail

• What is the public security compatibility condition?
• How do we apply the public security compatibility condition?

What is the public security compatibility condition?

You may collect personal information for a specified purpose and later need to reuse it to deal with a threat to public security. The UK GDPR allows you to reuse personal information to keep society safe and treats this as compatible with your original purpose.

Annex 2 says:

“Public security

3. This condition is met where the processing is necessary for the purposes of protecting public security.”

We call this the ‘public security compatibility condition’ (although this term is not used in the legislation itself). The UK GDPR does not give a definition of public security, but it’s likely to concern the welfare and protection of the public. It’s likely to include the protection of life, institutions and organisations against public threats, including: 

• crime;
• disasters; and
• other risks to life, safety and wellbeing.

How do we apply the public security compatibility condition?

If you need to reuse personal information for this purpose, you must:

• only intend to further use it to protect public security; and
• be able to demonstrate that further using the personal information is necessary for this purpose.

In some cases, you may need to decide quickly whether to reuse personal information to protect public security. If so, you should consider the following:

• Does reusing the personal information help to protect or support public security?
• Is reusing the personal information a reasonable way to do this?
• Is there a less intrusive way to achieve the same result, based on what you currently know?

If you answer ‘yes’ to the first two questions and ‘no’ to the last, it’s likely your use meets the necessity part of this condition. If your reuse is about responding to an emergency as defined in the Civil Contingencies Act 2004, the emergencies compatibility condition is likely to be more appropriate. If your reuse is specifically related to the prevention, detection and investigation of crime, you may find the crime compatibility condition more appropriate. 

Remember, if you originally collected the personal information using the consent lawful basis, you must consider whether it is reasonable to ask for consent for the new processing.

In any case, you must satisfy a lawful basis for reusing personal information in this way. You may decide it’s appropriate to rely on recognised legitimate interest and its national security, public security and defence condition. This is similarly worded to the annex 2 compatibility condition in relation to the public security element. However, you can’t use this if you are a public authority and the processing is part of your public tasks. Instead, as a public authority, you may find the public task lawful basis more appropriate in such cases.