What does “lawfulness, fairness and transparency” mean under the GDPR?

There are seven basic data protection principles under EU data protection law. The principles lie at the heart of the law and, although they don’t give hard and fast rules, they embody the spirit of the regulatory framework. The first principle is the principle of “lawfulness, fairness and transparency” (GDPR Article 5 (1) (a)).

Article 5 of GDPR

(1) Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

[See also Articles 6 and 9 of GDPR]

What is lawfulness?

For processing of personal data to be lawful, specific grounds for the processing (‘lawful basis’) must be identified. There are six main options with additional conditions for processing some especially sensitive types of data. If no lawful basis applies then the processing is unlawful and in breach of this principle.

Lawfulness also means that controllers and processors cannot do anything with the personal data which is unlawful in a more general sense. This includes statute and common law obligations, whether criminal or civil. If processing involves committing a criminal offense, it will obviously be unlawful. However, processing may also be unlawful if it results in:

• a breach of a applicable privacy laws;
• an infringement of copyright law;
• a breach of an enforceable contractual agreement; or
• a breach of industry-specific legislation or regulations;

Where entities process data unlawfully, data protection law gives individuals the right to erase that data or restrict the processing.

What is fairness?

In general, fairness means that processing must be done in ways that people would reasonably expect and not in ways that have unjustified adverse effects on them.

Assessing whether processing is fair depends in part on how the data was obtained and how the processing affects individuals. If anyone is deceived or misled when the personal data is obtained, then this is unlikely to be fair. Processing may negatively affect an individual without necessarily being unfair. What matters is whether or not such detriment is justified.

Example: Where personal data is collected to assess tax liability or to impose a fine for breaking the speed limit, the information is used in a way that may cause detriment to the individuals concerned, but the processing for these purposes will not be unfair.

What is transparency?

Transparency is fundamentally linked to fairness. Transparent processing means being clear, open and honest with people from the start about who you are and how you process data. Informing individuals in easily accessible and understandable language is the key, whether the controller has a direct relationship with the individual or not.

ICO Checklist

The Information Commissioner’s Office website includes a helpful Checklist that summarizes this principle:

Consequences of non-compliance

Failure to comply with data protection principles may lead to substantial fines. Article 83(5)(a) of GDPR states that infringements of the basic principles for processing personal data are subject to the highest tier of administrative fines. This could mean a fine of up to €20 million, or 4% of your total worldwide annual turnover, whichever is higher.

NOTES:

• There are more detailed provisions on lawfulness and having a ‘lawful basis for processing’ set out in Articles 6 to 10.
• There are more detailed transparency obligations set out in Articles 13 and 14, as part of the ‘right to be informed’.