Lawfulness (Article 5(1)(a) GDPR)

Under Article 5(1)(a) GDPR, personal data must be processed "lawfully". The principle restates the fundamental rights requirement laid down in Article 8(2), first sentence, of the Charter of Fundamental Rights of the European Union (CFR), under which personal data may be processed only with the consent of the data subject or on some other legitimate basis laid down by law.

1 Overview

1.1 Legal consequence and systematic context

The principle of lawfulness requires that a legal basis exist for every processing operation. Article 6(1) GDPR gives concrete expression to the principle through an exhaustive catalog of possible legal bases. Where no applicable legal basis exists, the processing is unlawful on that ground alone.

The principle corresponds to what German data protection law has traditionally called a "prohibition subject to permission". It does not presuppose compliance with all the further requirements of the GDPR; other aspects of the processing are covered by the remaining principles in Article 5 GDPR (transparency, data minimization, integrity and confidentiality). A breach of those principles does not automatically render the processing "unlawful" within the meaning of Article 5(1)(a), first alternative, GDPR, but it does constitute a breach of a principle in its own right and is subject to administrative fines.

1.2 A narrow understanding of "lawfulness"

Both Article 8(2) CFR and the scheme of Article 5(1) GDPR support a narrow understanding: lawfulness means the existence of a legal basis, not compliance with all the rules of the GDPR. A broad understanding would mean that any infringement (for example of the information obligations or of data security) would render the processing unlawful as a whole. Such a result cannot be reconciled with the fact that each of the individual principles operates on its own terms.

2 Requirements as to the legal basis

2.1 Clarity and precision

The legal basis on which a processing operation rests must govern the scope and application of the processing so clearly and precisely that the processing is foreseeable for the data subject. That follows from Recital 41, second sentence, GDPR and corresponds to the requirements that the CJEU has consistently applied to interferences with Articles 7 and 8 CFR (CJEU, judgment of 20 May 2003, C-465/00 and Others, Österreichischer Rundfunk, para. 77; CJEU, judgment of 8 April 2014, C-293/12, C-594/12, Digital Rights Ireland, para. 54).

2.2 Foreseeability for the data subject

Foreseeability is assessed from the objective perspective of the data subject as recipient. The data subject must be able to discern from the legal basis which processing operations are to be expected and on what grounds. The more sensitive the data or the more serious the interference, the higher the requirements to be placed on the specificity of the legal basis.

3 Interaction with the other principles

In substance, the principle of lawfulness is closely connected with the principle of transparency: only where the processing is foreseeable for the data subject can she exercise her rights effectively. At the same time, there is a close link with purpose limitation (Article 5(1)(b) GDPR): the legal basis must always support a specific purpose of processing.