One of the seven most important data processing principles of the GDPR is to ensure that personal data is processed lawfully, fairly and transparently. A rare treatment activity that may be necessary to save a person`s life. This is most often observed in emergency medical situations. Article 9(1) of the UK GDPR prohibits the processing of special category data (e.g. race, ethnic origin, health, genetic and biometric data) unless a condition is met. One of these conditions is that the processing is necessary for research-related purposes. The DSA sets out certain requirements to avail itself of this condition; that the processing is necessary, subject to the safeguards set out in Article 89(1) of the UK GDPR, is not likely to cause significant harm or suffering, is not used to measure or make decisions about individuals and is in the public interest. The legal basis for processing is also important as it has a significant impact on how an organisation responds to data subjects` requests for rights. Certain rights may be granted if consent is the legal basis for the processing or if the performance of a contract is the legal basis for the processing.
There are also other implications for the legal basis for the processing. For example, the processing of special types of data, including: race, ethnicity, health data, biometric data and other sensitive information, requires certain bases of processing. IIED research sometimes collects personal data related to criminal activities or offences within the meaning of Article 10 of the GDPR. If it is necessary to collect this category of data, IIED relies on the provision of the Data Protection Act 2018 Annex 1 Part 3 s29, which allows the processing of data from the criminal office with the consent of the data subject. Explicit consent will be obtained and we will endeavour to anonymize data at the source where possible. Without the processing of individuals` personal data, we would not be able to maintain a relationship with them in a manner necessary for the viable operation of the charity or conduct the research necessary to further our mission. We only collect personal data necessary for research purposes, fundraising or to develop and maintain a professional relationship. We will obtain consent or enter into a contract for anything that requires the processing of the “special category of personal data” or involves a financial transaction.
Yes. We will only process the data of persons who are related in any way to the work of IIED. This could be because they work in the field of sustainable development or a related sector, or they have a business interest in IIED and have been in contact with us, or they have provided us with a business card, or they have participated in an event or workshop, or they have funded similar work at IIED. We would not process the data of individuals who had no connection with IIED or its work on this legal basis. You must therefore record the basis on which you rely for each processing purpose and keep a justification of why you believe this is the case. There is no standard form for this, as long as you make sure that what you are registering is sufficient to prove that a legal basis applies. This will help you comply with your accountability obligations and draft your privacy statements. The Information Commissioner`s Office (ICO) guidelines on a legal basis state that no base is “better” or more important than the others, all are equally valid; In deciding on which basis to rely, the most appropriate basis depends on the purpose for which the data is processed and the relationship with the individual. The legal basis must be determined before the start of the processing and must be necessary to achieve the purpose for which it was processed. `Consent should be given by means of a clear affirmative act establishing a voluntary, specific, informed and unambiguous declaration of the data subject`s consent to the processing of personal data relating to him or her, for example by means of a written statement, including by electronic or oral means. Several of the legal bases relate to a specific purpose – a legal obligation, the performance of a contract with the person, the protection of a person`s vital interests or the performance of your public duties. If you are dealing for these purposes, the relevant legal basis may be obvious, so it is worth considering it first.
Many people – and organisations – focus on consent, but this is arguably the weakest legal basis for processing, as it can be withdrawn at any time. If you process special category data, you must provide both a legal basis for the processing and a special category for processing in accordance with Article 9. You must document both your legal basis for processing and your special category so that you can demonstrate compliance and accountability. Basis for public service tasks in Article 6(1)(e) `The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller` The ICO confirmed that the legal basis “public mission” may apply to any organisation exercising public powers or performing tasks in the public interest, which are established by law. It is important to note that one legal basis for processing is generally not superior to another legal basis for processing.
