July 31st, 2023 by James Goudie KC

Article 6 of the GDPR states that processing of data shall be lawful ONLY IF AND TO THE EXTENT that  at least one of 6 situations applies. These include when processing is NECESSARY for the performance of a task carried out in the PUBLIC INTEREST or in the exercise of official authority vested in the controller. In Case C-252/21, the META case, the CJEU Grand Chamber says at paras 108-112 inclusive that this means that the legitimate data protection issues pursued must not be reasonably capable of being achieved just as effectively by other means less restrictive of the rights and freedom of data subjects. A balance then requires to be struck. Particular attention must be paid when the data subject is a child.

Comments are closed.