Data Protection Policy

Appendix B - Lawful Basis for processing

Personal information:

The following are lawful basis for processing as outlined in Article 6 of the UK General Data Protection Regulations.

Basis	Explanation
6(a) Consent	The individual has given clear consent for you to process their personal data for a specific purpose.
6(b) Contract	The processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
6(c) Legal obligation	The processing is necessary for you to comply with the law (not including contractual obligations).
6(d) Vital interests	The processing is necessary to protect someone’s life.
6(e) Public task	the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
6(f) Legitimate interests	the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This does apply for a public authority processing data to perform its official tasks.)

Special Category Personal Information:

To process special category personal information, you need to identify both a lawful basis for personal information (as above) and a lawful basis for processing sensitive personal information as specified by Article 9 of the UK General Data Protection Regulations (as below). Only the available lawful basis for processing has been included below and the letters refer to the part of the legislation.

There is a presumption of seeking consent and this should be sought unless it is necessary to process without consent to achieve a targeted objective. If none of the basis below are suitable, you should not process special category personal information and should seek an alternative approach.

Basis	Explanation
9(a) Explicit consent	The subject has given clear consent for you to process their personal data for a specific purpose.
9(b) Employment, social security and social protection (if authorised by law)	Processing is necessary for the purposes of complying with employment, social security and social protection law. This may be used for, but not exclusively: checking if individuals are entitled to work in the UK; ensuring health, safety and welfare of employees; maintaining records of statutory sick pay and maternity pay; or deducting trade union subscriptions from payroll. An appropriate policy is required for this basis.
9(c) Vital interests	Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent. This is only deemed as necessary to protect an interest which is essential for the life of the data subject or that of another natural person.
9(e) Made public by the data subject	Processing relates to personal data which has been deliberately released into the public domain by the subject.
9(f) Legal claims or judicial acts	Processing is necessary for the establishment, exercise or defence of the Council’s legal claims or whenever courts are acting in their judicial capacity.
9(g) Reasons of substantial public interest (with a basis in law)	processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued. The specific public interest criteria can be found in Schedule 1, Paragraphs 6 – 28. Further information can be found in the ICO’s guidance. An appropriate policy is required for this basis.
9(h) Health or social care (with a basis in law)	processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.
9(j) Archiving, research and statistics (with a basis in law)	Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.