Skip to main content
Home

Vital interests compatibility condition

Contents

In detail

What is the vital interests compatibility condition?

You may need to reuse personal information you already hold to protect a person’s life. Data protection law recognises the importance of this and treats it as a compatible purpose. 

Annex 2 says:

“Protection of vital interests of data subjects and others 

7. This condition is met where the processing is necessary for the purposes of protecting the vital interests of the data subject or another individual.”

We call this the ‘vital interests compatibility condition’ (although this term is not used in the legislation itself).

The UK GDPR makes it clear that the concept of vital interests is only about interests that are essential for someone’s life. So, this compatibility condition is very limited in its scope and generally only applies to matters of life and death. 

This compatibility condition applies to protecting the vital interests of the person whose personal information you originally collected. It can also apply to protecting other people’s vital interests. In other words, you may rely on this compatibility condition if you need to further use someone’s personal information to protect another person from serious harm or risk to their life. For example, you may need to reuse a parent’s personal information to protect the vital interests of their child. However, this is not likely to happen often.

How do we apply the vital interests compatibility condition?

Data protection law allows you to reuse personal information when needed, and doesn’t stop you from using such information in ways that are necessary and proportionate to protect a person’s life. 

To apply the vital interests compatibility condition, you must:

  • intend to reuse personal information to protect people’s vital interests; and
  • ensure that reusing the personal information is necessary for this purpose.

To rely on this compatibility condition, your new use of personal information must be necessary to protect a person in matters of life and death. This means there is a high bar in using this condition and you have to show that you cannot achieve this purpose in any other way.

Given the limited nature of the condition, it’s likely to be relevant when you need to use someone’s personal information for their emergency care. This generally applies when a person is unconscious or otherwise incapable of giving their consent to the processing.

Even in a life-threatening situation, you must still have a lawful basis for your new processing. Given the circumstances, it is unlikely that you can rely on consent. Therefore, you will likely find the vital interests lawful basis more appropriate. There is a clear link between this annex 2 purpose and that lawful basis.

In such circumstances, you’re likely to be using a person’s special category data. This is because protecting their vital interests is likely to relate to their health. If this is the case, you must also have an article 9 condition for processing, as well as a lawful basis. There is a specific vital interests condition for processing special category data that is likely to be most appropriate. However, this only applies if the person is physically or legally incapable of giving consent.

Example

An employee suffers a life-threatening accident at work and is unconscious. The employer calls for an ambulance and, once they’re on site, the ambulance crew begin assessing and treating the employee.

The employer is aware that the employee has health issues, including allergies. It already uses this personal information to accommodate the employee’s personal needs in the workplace. The employer shares this information with the ambulance crew, as it’s necessary to help give appropriate care to the employee. 

Further reading – ICO guidance