Home › Public sites▻Corporate and Legal Affairs▻Data Protection▻GDPR▻Right to use Personal Data

Right to use Personal Data

In order for it to be legal and appropriate for the University to process Personal Data or Special Categories of Personal Data at least one of the following conditions must be met:

a)   The data subject has given his or her consent

b)   The processing is required due to a contract

c)   It is necessary due to a legal obligation

d)   It is necessary to protect someone’s vital interests (i.e. life or death situation)

e)   It is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

f)   It is necessary for the legitimate interests of the controller or a third party and does not interfere with the rights and freedoms of the data subject (this condition cannot be used by public authorities in performance of their public tasks).

 All processing of personal data carried out by the University must meet one or more of the conditions above. 

Universities are classified as public authorities and therefore the use of the ‘legitimate interests’ justification is not possible in terms of the University’s core activities (public tasks).  It may be possible to use legitimate interests for processing that is undertaken outside of the University’s public tasks.   

In addition, the processing of ‘Special Categories of Personal Data’ of personal data requires extra, more stringent, conditions to be met in accordance with Article 9 of the GDPR. When processing special category data, we also need to have a further lawful basis for processing from the following list:

  • that the data subject has given their explicit consent to the processing
  • that the processing by the data controller is necessary in the field of employment
  • that the processing is necessary to protect the vital interests of the data subject or another living individual, where the data subject is physically or legally incapable of giving consent
  • that the processing relates to personal data that has been made public by the data subject
  • that the processing is necessary for legal reasons
  • that the processing is in the substantial public interest
  • that the processing is necessary for occupational medicine
  • that the processing is necessary for reasons of public interest in the area of public health
  • that the processing is necessary for archiving purposes in the public interest, scientific or historical research or statistical purposes.