There are 6 bases for the processing of personal data
6 legal grounds for the processing of personal data can be the basis;
- You will receive explicit permission from the person whose data you are going to process;
- It is a necessary connection to process the personal data for which data minimization is also applied;
- In the case of a contractual agreement, for example when concluding an employment contract;
- Comply with a legal obligation;
- In the protection of vital interests;
- In the case of a task carried out in the public interest or in the exercise of public authority;
- The legitimate interest.
When must a basis be stated?
- The basis for processing personal data must always be stated at the start of the processing;
- According to art. 13 & 14 you must inform the data subject about the data you collect from him or her;
- Ensure transparency, even if the data you collect does not immediately come from the data subject.
- The processing of personal data must be lawful ,
- When processing special personal data such as medical, financial or biometric data, this is only possible in the following cases;
- You have the express permission,
- The processing is necessary,
- For the protection of the vital interests of the data subject,
- When the processing is carried out by an association in the context of its legitimate activities,
- Personal data made known by the data subject himself,
- For a judicial processing,
- The processing is necessary for reasons of important public interest,
- In prevention of occupational medicine,
- In the public interest in the field of public health such as in a pandemic,
- For archiving in the public interest, scientific or historical research,
- When the processing is carried out under the responsibility of a professional who is bound by professional secrecy under Union or Member State law.
- Processing of criminal convictions and offenses or related security measures should in principle not be processed unless under government supervision or if processing is permitted by Union or Member State law provisions that provide appropriate safeguards for human rights and freedoms . This also means that registers of criminal convictions may only be kept under government supervision.
Consent to the processing of personal data
It is not the case that if you obtain the consent of a person for the processing of his or her personal data, that you are allowed to process all data concerning that person just like that. It is only the data that you need to realize your purpose for the processing that you are allowed to process. Consent must always be free, specific and unambiguous.
Processing of personal data by contract
Personal data is processed in order to perform an agreement or to be able to comply with a contract. Here again, only the personal data that are relevant to achieve the purpose of the processing may be processed. It is also possible that personal data will be processed before a contract was entered into, in which case we speak of a pre-contractual relationship.
Processing of personal data in the event of a legal obligation.
If there is no freedom of choice and as a result the law imposes an obligation on you as a controller , we speak of a legal obligation. An employer is legally required to file a dimona declaration, for which the details of social security must be stated.
Processing of personal data necessary for vital interests.
The processing of personal data may be necessary to protect the vital interests of data subjects. The use is somewhat limited because it must be demonstrated that the processing is necessary and in order to guarantee the protection of the data subject. This ground is usually invoked when a life-threatening situation arises.
Processing of personal data in the public interest or public authority.
If the processing is necessary for the performance of a task in the public interest or a task for the exercise of public authority, such as a municipality is authorized to organize the parking policy, the necessary personal data can be processed. This can be done under a new law, a Royal Decree or applicable European regulations. The data subject can invoke the right to object here, but not the right to erasure.
Processing of personal data for the legitimate interest.
If the processing is necessary for the protection of the legitimate interests of the controller or a third party and the fundamental rights and freedoms of data subjects for the protection of personal data outweigh those interests if the data subject is a minor.
