The provisions of the RODO formulate specific legal grounds that allow controllers to process personal data. In addition to consent, necessity to enter into a contract or legal obligation, Article 6(1) of the RODO indicates the premise of the necessity of processing to protect the vital interests of the data subject or another natural person. When can this premise be invoked in practice when processing personal data?
Vital interest of the individual
In order to base the processing of personal data on the vital interest of an individual, first of all, the specific vital interest of the data subject or another individual must be specified. What should be understood by this term? It is about interests that are relevant to a person’s life – as is clear from Recital 46 of the RODO. Examples include humanitarian purposes, monitoring of epidemics and their spread, as well as emergencies such as natural and man-made disasters. The doctrine also points out that the vital interests of a person can also be spoken of in the case of the need to save life, health, as well as to protect property. It should be emphasized that the interests in question here must concern a natural person – the vital interest of a legal entity cannot be invoked.
Necessity of processing for the protection of vital interests.
However, the mere existence of vital interests of an individual is not sufficient to legally base the processing of personal data on this basis. The Polish supervisory authority indicates that this processing of personal data must be necessary to protect these interests. Thus, this applies to situations in which, on the one hand, there is a threat to the vital interests of the data subject or another natural person, and, on the other hand, the protection of these interests is not possible in any other way but through the processing of personal data.
Vital interest as a final premise
Recital 46 of the RODO itself further specifies that the vital interest of another individual can be the basis for the processing of personal data only in cases where it is clearly impossible to base the processing on another legal basis. This means that whenever we have the opportunity to use another legal basis for processing personal data, we should do so first. We find justification for this by reference to the legislator’s intentions for the introduction of the premise of protecting vital interests. Indeed, it is argued that “the intention of the legislator is to protect the interests of greater importance, which justifies the temporary disregard of the protection of human privacy, especially in the aspect of his informational autonomy” (A. Nerka, M. Sakowska-Baryła, in General Data Protection Regulation, p. 164). Therefore, the controller should consider whether in a given situation the priority is given to data protection rights, or whether the vital interests of the individual and the need to protect them are more important.
Protection of vital interests vs. sensitive data
The above discussion concerned so-called ordinary personal data. How does a person’s vital interest relate to the processing of special categories of data, known as sensitive data? They deserve special protection, and although the premise of protection of vital interests can be the basis for processing sensitive personal data, it is necessary to meet an additional condition. This is the circumstance that the data subject is physically or legally incapable of consenting to the processing of personal data.
Rationale for processing to protect the vital interests of the individual
In summary, in order to process personal data based on the premise of Article 6(1)(d) of the RODO, the following conditions must be met together:
1. there must be an interest that is relevant to the individual’s life (vital interest);
2. the processing of personal data is necessary to protect those interests;
3. the processing of personal data cannot be based on any other legal basis,
4. in the case of sensitive data – the data subject objectively cannot consent to the processing of such data.