The controller has the obligation to ensure that the processing of personal data is legal. Processing of personal data is carried out if there are:

  • Legal basis

Usually the legal basis for the processing of personal data is found in the legal regulations of a separate sector or area.[6]

  • Consent from the subject of personal data

The controller has the obligation to prove that the subject has given consent to the processing of his personal data. If the consent is given in the form of a written statement, it should be given in an understandable and easily accessible form, using clear and simple language. The subject has the right to withdraw the consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal.

In order to evaluate whether the consent to the processing of personal data is voluntarily given by the subject, it should be determined whether the fulfillment of the rights and obligations of the contract is conditioned by the given consent.[7]

The processing will be considered legal, if it is carried out for the purpose of:

  • Fulfillment of a contract in which the entity is a contracting party

In each specific case, it will be assessed which data are necessary for the purpose to be achieved by establishing the contractual relationship. Moreover, there is no general rule based on which the data that will be considered necessary for the respective purpose would be determined, so each specific contract should be thoroughly reviewed.[8]

  • Compliance with a legal obligation of the controller

Each controller has an obligation to disclose personal data from its collections, when there is a legal basis for doing so.[9]

  • Protection of the life or essential interests of the subject

This implies that the processing of personal data can also be carried out for the purpose of protecting the physical and moral integrity or other essential interests of the subject of the personal data.[10]

  • Execution of works of public interest or official authority

Invoking this legal basis sometimes presents a danger of discretionary action. To prevent this, the following criteria should be taken into account:

In the public sector, the execution of works of public interest or the execution of an official authorization of the controller or of a third party to whom the data has been disclosed, must have a basis in law. In the private sector, the authorization must have a basis in a specific legal act.[11]

  • Fulfillment of a legitimate interest of the controller

Any interest that is not contrary to fundamental legal principles can be considered legitimate, but if the data processing would threaten the fundamental rights and freedoms of the data subject, then his interests prevail and the processing will not be allowed. Hence, the balancing of interests can serve as a legal basis for personal data processing operations that cannot be brought under any other legal basis.[12]

[6] Example: The Electoral Code contains the legal basis for processing the personal data of citizens in the Electoral List.

[7] Example: Operators of electronic communication services, banks, insurance companies or any other companies, after establishing a business relationship with users, customers, policyholders, can use their personal data for direct marketing, only on the basis of their express consent. , which should be in a form that makes it possible to declare whether the data can be used for this purpose or not. Based on such consent, their personal data may be processed solely for direct marketing purposes, but not for other purposes.

[8] Example: Mainly, in every contract, the personal data of natural persons or the representatives of legal persons as contractual parties are processed (name and surname, place of residence, social security number, ID card number), but whether and what other personal data will be processed depends on the subject of the contract and the purpose for which it is concluded.

[9] Example: Natural and legal persons, state authorities or other bodies have the obligation to submit personal data to the competent courts, for the purpose of presenting them as evidence in court proceedings, when these data are requested in a manner established by law.

[10] Example: In exceptional cases, such as natural disasters, emergency or war, etc., the authorized authorities will have the right to disclose certain personal data (name and surname, location) in order to find or rescue a certain person.

[11] Example: The Public Health Institute and the Public Health Centers for the purpose of performing work in the public interest – timely prevention and prevention of the spread of an infectious disease, may process personal data of sick persons, but also of persons with whom the sick were in contact .

[12] Example: The personal data of a certain subject (name and surname and telephone number) are publicly published in a telephone directory for a specific purpose – making contact. These personal data, which have previously been publicly published in a telephone directory, may also be processed for another purpose – to conduct research, if the subject is asked if he agrees to participate in the research. At the same time, such processing of personal data will be considered legitimate, especially because in this way the freedoms and rights of the subject are not threatened. However, the use of data from the telephone directory for performing direct marketing will not be able to be brought under this legal basis, because in the ZZLP it is explicitly stated that direct marketing can be carried out exclusively on the basis of the express consent of the subject of personal data .