For data processing to be lawful, it has to meet the following criteria:
Processing of your personal data must be allowed by law.
example Video monitoring at your workplace is allowed by Article 26 of the Act on the Implementation of GDPR, but only under specific circumstances.
Processing of your personal data must be necessary in order to achieve a legitimate aim, in other words, to protect other legitimate interests. In the field of data protection, three legitimate aims usually play an important role:
- public safety
- prevention of disorder and crime
- protection of the rights and freedoms of others
example If you work in a kindergarten, which is constantly monitored using video cameras, you will find that the aim of this policy is to protect the rights of children and their parents.
Interference must indeed be necessary and suitable for the achievement of the legitimate aim. Other alternative means to achieve this aim, which could be less restrictive and at the same time as effective as the means used, should not exist.
example If the media has published your picture in a newspaper along with an article about a huge public demonstration outside the Cabinet of Ministers’ building in which you were a participant, the media has exercised its freedom of expression to inform society about important issues of general interest. At the same time, whether it was possible to mask your face in the picture should be considered, so that society can be informed, and your identity kept secret at the same time.
Interference must be proportionate to the legitimate aim pursued. At this stage, both competing interests have to be balanced against each other and a fair balance should be struck between the two. The reasons one has chosen to justify the interference must be relevant and sufficient in the particular situation.
example In the case of video monitoring at a workplace, your employer would have to prove why the protection of persons and property is more important than your right to control the recording of your image.