1. Legal Basis (Article 6(1)(e) GDPR)

GDPR explicitly provides “public interest” as one of the six lawful bases for processing:

“Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.”

So, controllers can lawfully process personal data without consent if:

• They are performing a task in the public interest, AND
• The basis for this processing is laid down in EU or Member State law.

2. Conditions for Use

To rely on this legal ground:

1. The processing must be necessary (not just useful or convenient).
2. The task must be carried out in the public interest.
3. The task or authority must be established in law (EU regulation, Member State law, or national legal framework).

3. Examples of Public Interest Processing

• Healthcare & Epidemic Control
• Processing personal health data for disease control, vaccination programs, or protecting public health.
• Education
• Universities processing student records under statutory education law.
• Elections
• Electoral commissions processing voter registration and eligibility.
• Social Security / Welfare
• Public bodies processing data to provide pensions, grants, or unemployment benefits.
• Statistics & Research
• National statistics offices collecting census data.
• Public Safety & Justice
• Law enforcement processing data for crime prevention (with limits under the Law Enforcement Directive, not GDPR directly).

4. Special Category Data (Article 9(2)(g))

When processing special categories of data (sensitive data such as health, biometric, racial/ethnic origin, etc.), GDPR requires an additional layer of justification.

Public interest can apply under Article 9(2)(g):

• Processing is allowed where necessary for reasons of substantial public interest,
• On the basis of Union or Member State law, and
• Subject to proportionality and safeguards.

Example: Processing biometric identifiers for identity verification in national security systems.

5. Safeguards Required

When using public interest as a legal ground, controllers must ensure:

• Proportionality: The scope of processing must not exceed what is needed.
• Transparency: Data subjects are informed of their rights and the purpose.
• Accountability: Documentation of lawful basis in Article 30 records.
• Safeguards: Policies, security measures, and DPIAs for high-risk operations.

✅ Conclusion

• Article 6(1)(e) = lawful basis for public interest processing.
• Must be necessary and based in law (EU or Member State).
• For special category data, Article 9(2)(g) applies, requiring substantial public interest and safeguards.
• Common sectors: healthcare, education, welfare, research, elections, justice.