Definition of "Public Interest" when applied to GDPR?

[elsiegee40]

Can someone (@grumbledook?) define "public interest " for me legally?

 

It seems to me that, in GDPR threadS, it's being cited in cases where it's in the interests of the parent or school, but hardly the public at large.

Edited August 13, 2017 by elsiegee40
Thread split so edited post to make sense

[Steve21]

As always everything ICO is woolly But yes you're right in that sense elsiegee.

 

In multiple areas of its rules the ICO states about the public interest isn't always in relation to the general public but public good etc etc

 

A small group unless specifically targeted for an exemption wouldn't count unless they've changed it recently

 

Steve

[GrumbleDook]

Can someone (@grumbledook?) define "public interest " for me legally?

 

It seems to me that, in this thread, it's being cited in cases where it's in the interests of the parent or school, but hardly the public at large.

 

As always, IANAL, but taking from a number of legal articles and referring back to the GDPR itself ... from Article 6(1) and Rec. 40-50

 

6(1)(e) – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

 

(45) Where processing is carried out in accordance with a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, the processing should have a basis in Union or Member State law. This Regulation does not require a specific law for each individual processing. A law as a basis for several processing operations based on a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority may be sufficient. It should also be for Union or Member State law to determine the purpose of processing. Furthermore, that law could specify the general conditions of this Regulation governing the lawfulness of personal data processing, establish specifications for determining the controller, the type of personal data which are subject to the processing, the data subjects concerned, the entities to which the personal data may be disclosed, the purpose limitations, the storage period and other measures to ensure lawful and fair processing. It should also be for Union or Member State law to determine whether the controller performing a task carried out in the public interest or in the exercise of official authority should be a public authority or another natural or legal person governed by public law, or, where it is in the public interest to do so, including for health purposes such as public health and social protection and the management of health care services, by private law, such as a professional association

 

(46) The processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of the data subject or that of another natural person. Processing of personal data based on the vital interest of another natural person should in principle take place only where the processing cannot be manifestly based on another legal basis. Some types of processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread or in situations of humanitarian emergencies, in particular in situations of natural and man-made disasters.

 

 

(50) The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. In such a case, no legal basis separate from that which allowed the collection of the personal data is required. If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations.

 

 

I'll try and get these clarified next week (still quite ill at the moment) but effectively it seems that we have 3 areas; legal obligations - these need to be tied in which existing legal acts and it *should* be Govt departments giving advice to remind people what these are (DfE responses to me so far have reminded me that schools are their own Data Controller and it is their legal responsibility to make sure they act as such) as well as advising on how the new act will need to have conflicts clarified (if any exist), vital interests - which should be determined by the DPA of member states when they enact any law pertaining to GDPR (we'll have to see what happens in the Bill) but there are some examples in there, and public interests - which should be determined by the DPA of member states when they enact any law pertaining to GDPR (we'll have to see what happens in the Bill) but there are again some examples. The education of a child, and allowing for T&L to take place, could easily be equated to the example given of public health.

 

To some extent, the ICO's explicit guidance will help when their materials for schools come out, as well as any updates from DfE (such as their updated guidance on Privacy Notices, which is due sometime this month). In the meanwhile, even if schools just do a data audit of what they have, how they got it, where they store it and why they are using it *at this time* it will make life easier to work through what they will or won't do with data later on.

[jdoyle]

Can someone (@grumbledook?) define "public interest " for me legally?

 

as you'll gather, I have a problem with the term public interest. I can take a guess as to what it means but it would just be a guess (doing right by society as a whole?)

 

A hospital working in its own bubble that takes organs from deceased patients to aid and potentially save the life of those with health problems without permission could argue that they are acting in the public interest but we know that when found out and exposed in the public domain, the lack of consent and legal authority exposes them to media scrutiny, a damaged reputation and potentially law suits.

 

the text re public interest carries the phrase "or in the exercise of official authority vested in the controller" without making clear who is entitled to give authority and in what form that should be given - while not data related, a surgeon in the hospital example may claim they were given authority by the hospital directors/trustees. That "authority" doesn't have the authority. The whistleblower (if there is one) or journalist who highlights the issue may actually be the ones deemed to be acting in the public interest.

 

Like hospitals, schools work in their own bubbles of expertise, procedures, financial constraints, issues. Generically as part of the NHS and the Education system, they are working for the public interest with Acts of Parliament etc to provide the legal framework and finances for their workings.

 

My take is that data collected and labelled public interest should generate alarm bells. Legal obligation and consent look a lot safer to work with.

 

ESCR did some work on the term a few years ago and refers to 5 usages in court which may be of interest

 

How the term arises in court | Public Interest in UK Courts

[GrumbleDook]

I have a similar issue with Vital Interests ... close enough to compliance with a legal obligation, but not close enough to be mentioned *as* an obligation in the relevant acts?

 

With all the Statutory Guidance out there on the National Curriculum, it doesn't give lesson plans, tell teachers where to stand in the classroom, what tools and resources to use, yet schools are legally obliged to educate the children enrolled at that school. If I am to teach KS1 Science (gathering and recording data to help in answering questions), then I might say that I would use product x, which also means that I can provide parents with information about what data has been gathered and recorded. Is this me gathering PII from both pupils and parents as part of my legal obligation or as part of Vital Interest ... or is it in the Public Interest that I use the most appropriate tools and resources to deliver the best level of education for each child?

 

Actions taken by staff, who deem themselves to be working in the public interest, still have to comply with laws and also documented and agreed working practices. If the laws and employer policies say that you should not do X and you do it, then it is subject to challenge (legally and contractually). Whistleblowing is a perfect example, where you should not breach laws and policies, yet there should be policies in place to handle this ... and it is subject to the public interest test too.

 

Whilst it would be ideal that everything was covered by compliance with legal obligation, I doubt it will be ... as the acts do not have enough specifics in them and even the Statutory Guidance is frequently designed to give freedom and flexibility to the experts (teachers and SLT). Leaving the rest as consent would place unreasonable boundaries on schools about how they can teach and how they manage the school.

 

To some extent most suppliers will (should) be looking at what data their software makes use of, know how it is used within schools and providing some guidance on it themselves (they will generally be talking to lawyers and IRM/DP specialists on this) so hopefully that will also help schools.

 

The rest will be down to Guidance from Govt Depts, ICO, Best Practice and eventually case law.

[jdoyle]

I stay clear of Vital Interests as the ICO suggest it relates to life and death situations

 

"The processing is necessary to protect the individual’s “vital interests”. This condition only applies in cases of life or death, such as where an individual’s medical history is disclosed to a hospital’s A&E department treating them after a serious road accident."

 

 

but I suppose a school would be justified in collecting student, staff and governors medical data for such an emergency and flagging that as vital interest.

[GrumbleDook]

Yes, certain Safeguarding aspects hit the criteria too, and areas that could affect H&S (including mental health) as well.

 

All areas that are nearly, but not quite in the compliance with legal obligations due to lack of specifics, from what I have seen so far.

 

As always, Still asking advice on these and if anything gets clearer I'll share the references.

[pcstru]

Can someone (@grumbledook?) define "public interest " for me legally?

That is not a simple question.

[jdoyle]

the text @GrumbleDook posted re para 45 gives a bit more comfort re public interest

 

"where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, the processing should have a basis in Union or Member State law"

 

It sounds like if you claim public interest you would need to know which bit of legislation you are linking the claim to.

[GrumbleDook]

And, to some extent, this is were *education* delivery is coming in ... we can link it to Acts and Statutory Guidance, but allow the school to justify the specifics.

 

It isn't nice or neat at times and there are plenty of hurdles we will have to jump across.

 

From a supplier side, I'm just working hard on making sure that where we collect and process data, we can provide schools with justification. Location is going to be the interesting example. We need to show we record it (needed to allow configure to change based on location) but we don't have to allow the detail to be shown ... but this means a level of automation ... so yes, it is going to take time and *everyone* will be searching for answers. Don't panic though ... just get what you can and then give it to your DPO to handle