The ICO exists to empower you through information.

Overall ratings

Public task

Consent 

Contract

Legal obligation 

Vital interests

Legitimate interests

The below lawful basis are likely to be appropriate for your data processing activities

Legal obligation: Your answers indicate that legal obligation is likely to be an appropriate lawful basis.

 

Suggested actions

You need to ensure that you can demonstrate how and why processing is necessary for compliance. Remember to:

  • document your decision that processing is necessary for compliance with a legal obligation;
  • identify an appropriate source for the obligation in question; and
  • include information about your purposes and lawful basis in your privacy notice.

    If you are processing special category data or criminal offence data, you also need to identify a separate condition to allow you to process this type of data. 

Vital interest: Your answers indicate that vital interests is likely to be an appropriate lawful basis.

 

Suggested actions

You need to ensure that you can demonstrate why processing is necessary to protect vital interests. Remember to document your decision, and include information about your purposes and lawful basis for this type of processing in your privacy notice where possible.

If you are processing special category data or criminal offence data, you also need to identify a separate condition to allow you to process this type of data. In most cases the protection of vital interests is likely to arise in the context of health data. This is means you will also need to identify a condition for processing special category data under Article 9.

There is a specific condition at Article 9(2)(c) for processing special category data where necessary to protect someone’s vital interests. However, this only applies if the data subject is physically or legally incapable of giving consent. This means explicit consent is more appropriate in most cases, and you cannot in practice process special category data (including health data) for this purpose if the data subject refuses consent, unless they are not competent to do so. 

Public task: Your answers indicate that public task is likely to be an appropriate lawful basis.

 

Suggested actions

You need to be sure that you can demonstrate why processing is necessary to perform a task in the public interest or exercise your official authority. Remember to:

  • document your decision that the processing is necessary for you to perform a task in the public interest or exercise your official authority;
  • identify the relevant task or authority and its basis in common law or statute; and
  • include information about your purposes and lawful basis in your privacy notice.

If you are processing special category data or criminal offence data, you also need to identify a separate condition to allow you to process this type of data. There are specific conditions for parliamentary, statutory or governmental functions in the substantial public interest.

Your answers were inconclusive for the following lawful basis

The lawful basis below are not appropriate for your data processing activities

Contract: Your answers indicate that contract is not an appropriate lawful basis.

 

Suggested actions

You need to show that you are using the data to provide a service to the individual at their request. If this is not the case, you should look for another lawful basis for this processing that better reflects your purposes.

Consent: Your answers indicate that consent would not be appropriate and/or is likely to be invalid.

 

Suggested actions

If you can't offer a genuine free and ongoing choice, you should look for another lawful basis for your processing.

Legitimate interest: Your answers indicate that legitimate interests is not an appropriate lawful basis.

Suggested actions

You need to look for another lawful basis, or else rethink your processing. In particular, you should consider the 'public task' basis for processing to perform your tasks as a public authority.

 

If you have an problem downloading the report into a word document please let us know.