1

Suppose I get a request from a law enforcement agency, for data that I'm already processing legally. Can I just give the information to the agency, or do I need to verify that I am under a legal obligation to do so (for example, the agency has a search warrant for the information requested)?

Improve this question
1
  • Is you intent to limit your question to information you are otherwise obligated to keep private under gdpr? Certainly, in the case of information that gdpr does not obligate you to keep private, the answer is obvious that you can divulge it.
    – ohwilleke
    Mar 30, 2022 at 21:00

2 Answers 2

Reset to default
2

You need a legal basis, but not necessarily an Art 6(1)(c) legal obligation. Interesting alternatives include:

  • Art 6(1)(d): Disclosing this information is necessary for the vital interests of a person, and no other legal basis would apply. Here, vital interests means that lives are at stake. But it doesn't have to be the data subject's life, and the risk can relate to a large group of people. For example, Recital 46 mentions humanitarian emergencies like disaster response and monitoring epidemics.
  • Art 6(1)(e): Disclosing this information is necessary for performance of a task in the public interest, and there are more specific national or EU laws that permit this disclosure (without requiring it). This will rarely apply to private-sector data controllers.
  • Art 6(1)(f): Disclosing this information is necessary for the purposes of a legitimate interest, and you have conducted a balancing test that shows that this legitimate interest overrides the interests, rights, and freedoms of the affected persons.

You cannot disclose the data without any legal basis. In practice, only an Art 6(1)(f) legitimate interest could typically apply. But the safest approach from a GDPR perspective would be to wait for a court order. The issue with legitimate interests is that now you would have to weigh the interest against the data subject rights, which is otherwise the job of the court (in theory).

Improve this answer
1

You cannot "just give" the data to anyone, not even law enforcement

  1. You must consider the purpose of sharing the data and if it is necessary and proportionate to do so.

  2. you must have a legal basis to disclose the data under Article 6. If sharing the data was not the original intention. For example, sharing CCTV data from cameras installed to detect crime probably is an original intention, sharing timesheet data probably isn't. Assuming we're talking about the police, if we're talking about tax authorities that's probably reversed.

  3. If the data is special category data, you also need a condition for processing under Article 9.

  4. If the data is criminal offence data, you also need a condition for processing under Article 10.

  5. You need to record your lawful basis and, if applicable, your conditions.

  6. You can only share the minimum necessary amount of data.

  7. Sharing must be in compliance with other data protection obligations such as fairness, accuracy and security.

See this page from the UK Information Commissioner's Office.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .