5

Scenario:

  • A business has a legal requirement to obtain a license from a government agency relating to its business activities.
  • The business activities have already being undertaken and there is no way to avoid the need for the license (e.g. by ceasing the activities).
  • The license application form asks for customers' personal data (names plus basic details relating to their contracts e.g. dates).
  • The business feels uncomfortable divulging such data to the government, and is pretty sure their customers would be unhappy if they knew about it.
  • The business, the customers, and the government, are all located in the EU.

What is the position in relation to GDPR? Can the business refuse to complete the relevant sections of the license application?

My starting point is GDPR Articles 4(2) and 6(1)(c) (emphasis added):

4(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

6(1) Processing shall be lawful only if and to the extent that at least one of the following applies: (c) processing is necessary for compliance with a legal obligation to which the controller is subject;

This would seem to indicate to me that the business does indeed have to divulge the information. Is this correct?

Improve this question
0

1 Answer 1

Reset to default
6

Your analysis so far seems correct. You must comply with all applicable laws. The GDPR's Art 6(1)(c) legal basis clarifies that having to provide personal data is no excuse: that legal obligation is all the legal basis you need for sharing the personal data in accordance with your obligations.

However, that legal basis doesn't generally excuse you from your other data controller obligations. For example, you should still inform the data subjects about the processing as per Art 13(3).

Improve this answer
1
  • 1
    This is similar to the US's HIPAA health privacy act. There are built-in exceptions for when disclosure of medical information is necessary to comply with other laws, such as public health surveillance requirements or compliance with subpoenas. The intent is not to create an inviolate fortress of data, but to prevent arbitrary, unfair, or harmful disclosure.
    – Robert Columbia
    May 9, 2022 at 11:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .