Scenario:
- A business has a legal requirement to obtain a license from a government agency relating to its business activities.
- The business activities have already being undertaken and there is no way to avoid the need for the license (e.g. by ceasing the activities).
- The license application form asks for customers' personal data (names plus basic details relating to their contracts e.g. dates).
- The business feels uncomfortable divulging such data to the government, and is pretty sure their customers would be unhappy if they knew about it.
- The business, the customers, and the government, are all located in the EU.
What is the position in relation to GDPR? Can the business refuse to complete the relevant sections of the license application?
My starting point is GDPR Articles 4(2) and 6(1)(c) (emphasis added):
4(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
6(1) Processing shall be lawful only if and to the extent that at least one of the following applies: (c) processing is necessary for compliance with a legal obligation to which the controller is subject;
This would seem to indicate to me that the business does indeed have to divulge the information. Is this correct?