What is "Vital Interest" under the GDPR?
The GDPR's vital interests lawful basis is reserved for exceptional situations where processing is necessary to protect someone's life. Learn when this narrow legal basis applies, why necessity is essential, its limits for special category data, and the documentation controllers should maintain.
Key points: (1) The vital interests lawful basis applies only when processing is necessary to protect someone's life. (2) Processing must be objectively necessary. If the person's vital interests can reasonably be protected in a less intrusive way, this lawful basis does not apply. (3) You cannot rely on vital interests to process special category data (including health data) if the individual is capable of giving consent, even if they refuse to consent. (4) Controllers should identify and document the limited circumstances in which this lawful basis applies and be able to justify why the processing was necessary to protect vital interests.
It’s clear from GDPR recitals that vital interests are intended to cover only interests that are essential for someone’s life. So this lawful basis is very limited in scope, and generally only applies to matters of life and death (e.g. medical emergencies).
Example: An individual is admitted to the A & E department of a hospital with life-threatening injuries following a serious road accident. The disclosure to the hospital of the individual’s medical history is necessary in order to protect his/her vital interests. (Note however that for medical care that is planned in advance another lawful basis such as public interest or legitimate interests is likely to be more appropriate.)
Processing of one individual’s personal data to protect the vital interests of others is unlikely to occur. It may be relevant, for example, if it is necessary to process a parent’s personal data to protect the vital interests of a child. Vital interests is also less likely to be the appropriate basis for processing on a larger scale but might be applicable in monitoring epidemics.
Vital interests is also less likely to be the appropriate basis for processing on a larger scale. Recital 46 does suggest that vital interests might apply where you are processing on humanitarian grounds such as monitoring epidemics, or where there is a natural or man-made disaster causing a humanitarian emergency.
Health data is one of the special categories of data, which means in addition to lawful basis controllers will also need to identify a condition for processing special category data under Article 9.
