Principles and lawful bases

The Article 5 principles

• Lawfulness, fairness and transparency.
• Purpose limitation: collected for specified, explicit and legitimate purposes and not further processed incompatibly.
• Data minimisation: adequate, relevant and limited to what is necessary.
• Accuracy: accurate and, where necessary, kept up to date.
• Storage limitation: kept in identifiable form no longer than necessary.
• Integrity and confidentiality: appropriate security.
• Accountability: the controller is responsible for, and must be able to demonstrate, compliance.

The six lawful bases

Article 6(1) sets out six bases: consent; contract; legal obligation; vital interests; public task; and legitimate interests, which public authorities cannot use for processing in the performance of their tasks. The basis must be chosen before processing starts, recorded and explained in the privacy notice. It should not be swapped later because the first choice proves inconvenient.

Consent must be freely given, specific, informed and unambiguous, given by a clear affirmative act, and as easy to withdraw as to give. Where there is a clear imbalance of power, as between employer and employee, consent is unlikely to be freely given. Legitimate interests requires a three-part test — purpose, necessity and balancing — which should be written down.

Special categories and criminal data

Article 9 prohibits processing data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and genetic data, biometric data used for identification, health data, and data about sex life or sexual orientation, unless an Article 9(2) condition applies — for example explicit consent, employment and social protection law, vital interests or substantial public interest. Criminal offence data (Article 10) needs official authority or a basis in Union or Member State law. The age at which a child can consent to online services ranges from 13 to 16, depending on the Member State.