Legal Grounds for Data Processing

Article 6(1) GDPR sets out the conditions that must be satisfied for the processing of personal data to be lawful. These are:

  • Consent of the data subject;
  • Necessary for the performance of a contract with the data subject or to take steps preparatory to such a contract;
  • Necessary for compliance with a legal obligation;
  • Necessary to protect the vital interests of a data subject or another person where the data subject is incapable of giving consent;
  • Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • Necessary for the purposes of legitimate interests.

Please visit: https://gdpr-info.eu/chapter-2/ 

 

Nevertheless, under the Finnish Data Protection Act, the principles of accuracy, storage limitation and integrity and confidentiality do not apply to processing of personal data solely for academic, artistic and literary expression purposes.

The Finnish Data Protection Act clarifies that processing necessary for the public interest or in the exercise of official authority includes:  

  • processing describing a person’s role, tasks or the performing of such role or tasks in a public entity, business activities, organisational activities or other similar activities; or
  • processing that is necessary and proportionate for the performance of a task carried out in the public interest; or
  • processing that is necessary for scientific or historical research purposes or statistical purposes and is proportionate to the legitimate interest pursued in the public interest; or
  • processing of personal data included in research material, cultural heritage material and descriptions of such material for archiving purposes is necessary and proportionate for the aim pursued in the public interest and for data subjects’