Legal Grounds for Data Processing

Personal data may only be processed where:

  • the data subject has unambiguously given his/her consent for the processing;
  • the processing is necessary for the performance of a contract to which the data subject is party, or for actions to be carried out at the request of the data subject and which are necessary for the conclusion of a contract;
  • the processing is necessary in order to comply with a legal obligation to which the responsible party is subject;
  • the processing is necessary in order to protect a vital interest of the data subject;
  • the processing is necessary for the proper performance of a public law duty by the administrative body concerned or by the administrative body to which the data are provided; or
  • the processing is necessary for upholding the legitimate interests of the responsible party or of a third party to whom the data are supplied, except where the interests or fundamental rights and freedoms of the data subject, in particular the right to protection of individual privacy, prevail.

Under the UVAG, it is impossible to withdraw consent to the processing of personal data for journalistic purposes, for example to withdraw consent to the publication or broadcasting of an interview once given.

The Article 29 Working Party has issued Guidelines on Consent (WP259).