Enter to open, tab to navigate, enter to select
Task carried out in the public interest
Practical Law Glossary Item w-014-8206 (Approx. 3 pages)
Glossary
Task carried out in the public interest
The terms often describes one of the legal grounds on which a controller can lawfully process personal data.
The term may have specific definitions in certain jurisdictions. Under the General Data Protection Regulation (GDPR), for example, processing can be justified if it necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e) and Recital 45, GDPR). For further information, see Practice note, Overview of EU General Data Protection Regulation: Lawfulness.
The basis for processing under Article 6(1)(e) of the GDPR shall be laid down by Member State law and member states have the right to maintain or adapt more specific provisions including measures for the specific processing situations set out in Chapter IX of the GDPR (Article 6(2) and 6(3), GDPR).
The grounds on which processing of special category data is permitted includes where it is necessary for:
- Reasons of substantial public interest on the basis of Union or Member State law (Article 9(2)(g), GDPR).
- Reasons of public interest in the area of public health (Article 9(2)(i), GDPR).
- Archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR based on Union or Member State law (Article 9(2)(j), GDPR).
Personal data can be stored for longer periods if the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (Article 5 (1)(e), GDPR). Also, if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, EU or member state law may determine and specify the tasks and purposes for which the further processing shall be regarded as compatible and lawful (Recital 50, GDPR) (see Practice note, Overview of EU General Data Protection Regulation, Purpose limitation).
Certain data subject rights can be restricted specifically where the processing is necessary for a task carried out in the public interest (Articles 17(3), 20(3) and 21(6), GDPR). Also, member state law may provide for derogations from the data subject rights in Articles 15,16, 18, and 21 when processing personal data for archiving purposes in the public interest (Article 89, GDPR). For more information, see Practice note, Data Subject Rights Under the GDPR.
There are a limited number of derogations that can be used for cross-border data transfers in the absence of an adequacy decision or appropriate safeguards, including where the transfer is necessary for important reasons of public interest (Article 49(d), GDPR) (see Practice note, Cross-Border Personal Data Transfers: Overview: Important Public or Security Interests).
In the UK, the Data Protection Act 2018 (DPA 2018) specifies that a task carried out in the public interest or the exercise of official authority (as permitted by Article 6(1)(e) of the UK GDPR) includes processing necessary for:
- The administration of justice.
- The exercise of a function of Parliament.
- The exercise of a function conferred on a person by enactment or rule of law.
- The exercise of a function of the Crown, a Minister, or a government department.
- An activity that supports or promotes democratic engagement.