Lawful processing conditions for personal data

Summary

This ODPA guidance explains that anyone collecting or using personal data in Guernsey must first identify and document a lawful processing condition (lawful basis) under Section 7 and Schedule 2 of the Data Protection Law, before processing begins. It clarifies that consent is only one of several available conditions and that most conditions require the processing to be 'necessary' for the stated purpose.

• Consent: The data subject has requested or given consent to the processing.
• Contractual: Processing necessary for performance of a contract with, or in the interests of, the data subject.
• Vital interests: Processing necessary to protect vital interests of the data subject or another individual.
• Public function: Processing necessary for a public authority's public function or task.
• Legitimate interests: Processing necessary for legitimate interests, not available to public authorities.
• Law / Enactment / Court order: Processing necessary to exercise a right, power or duty imposed by law or enactment, or to comply with a court order or judgement.
• Public domain: Information has been deliberately made public by the data subject.
• Health, social or public health: Processing necessary for a health or social care purpose.
• Legal proceedings / rights: Processing necessary for legal proceedings, court or tribunal functions, legal advice, or establishing/defending legal rights.
• Administration of justice / Crown function: Processing necessary for the administration of justice or a Crown, Law Officer, States or public committee function.
• Law enforcement: Processing necessary for a law enforcement purpose (governed separately by the Law Enforcement Ordinance).
• Not-for-profit: Processing in the context of not-for-profit political, philosophical, religious or trade-union organisations.
• Historical / scientific: Processing necessary for historical or scientific purposes.
• Equal opportunity: Processing necessary for equal opportunity purposes.
• Regulation / enactment: Processing authorised by regulation or other enactment.

Special category data (such as racial or ethnic origin, health, biometric or criminal data) is subject to a separate, more restrictive set of conditions not listed here, and processing for law enforcement purposes must instead be assessed against section 5 and Schedule 2 of the Law Enforcement Ordinance.

Key obligations

• Identify and document a lawful processing condition under Section 7 and Schedule 2 of the Law before starting to collect or use personal data.
• Ensure at least one of the listed lawful conditions applies to any processing of personal data that is not special category data.
• For special category data, identify and document the separate applicable condition (not itemised in this guidance) before processing.
• For processing carried out for a law enforcement purpose, consult section 5 and Schedule 2 of the Law Enforcement Ordinance rather than the general conditions.
• Only rely on a 'necessity' based condition where the purpose could not reasonably be achieved without the processing.

Applies to

data controllers, public authorities, not-for-profit organisations