The processing of personal data by public bodies is regularly an encroachment on the fundamental rights to private life (Art. 7 CFR) and data protection (Art. 8 CRF) or - at least in Germany - on the right to informational self-determination (Art. 2 I in connection with Art. 1 I Grundgesetz).

Data processing therefore requires a legal basis, must pursue a legitimate aim and must be suitable, necessary and appropriate to achieve the aim.

Legal basis: The GDPR alone will only be the legal basis for data processing in the public interest in rare cases. At least according to the prevailing opinion in Germany, a special legal basis will be required, which must meet the requirements of Art. 6 II and III GDPR and, in addition, probably also the requirements of the case law of the German Federal Constitutional Court.

 

Legitimate aim: The aim pursued by the data processing is legitimate if it is an aim recognised by the Union and serving the public interest (Art. 52 I CFR). The GDPR contains numerous public interests that constitute legitimate aims. They are listed on the tiles of this page. The public interests listed in the GDPR are not exhaustive.

 

Proportionality: The data processing enshrined in law must be suitable and necessary to achieve the legitimate aim. Furthermore, it must be proportionate and must respect the essence of the fundamental rights concerned (Art. 52 I CFR).