white_paper_on_data_protection_in_india_171127_final_v2

This ground covers two types of scenarios. First, where processing is necessary for the
performance of a contract to which the data subject is a party. This is a strictly interpreted
provision and does not cover situations where processing is not genuinely necessary for the
performance of a contract, and is unilaterally imposed by the entity processing information.
Therefore, a determination of the precise rationale of the contract, its substance and
fundamental objective is essential. 474
Second, this ground is also intended to cover any processing activity, which could take place
prior to entering a contract. This includes pre-contractual relations, where the steps are taken
at the initiative of the individual. For example, if an individual requests an insurance quote
from a car-insurance company, the insurer would be justified in processing the individual‘s
personal data in order to provide this service. 475
(ii)
Legal Obligation
For this ground to be applicable, processing of personal information must be necessary for
compliance with a legal obligation, or a mandatory requirement under law. 476 For instance, if
a bank were required to report suspicious transactions under anti-money laundering laws, this
situation would be covered under this ground.
(iii) Vital Interest
This ground may be used only in very limited circumstances, such as where there is a there is
a threat to the life or health of the individual. The Recitals to the EU GDPR clarifies that this
ground must only be used to protect an interest essential to the life of the individual. 477
However, there is no clarity on what constitutes a threat to life, whether the threat must be
immediate, and what the scope of this ground should be.
(iv) Public interest task, or the exercise of official authority
The ground dealing with public interest covers two situations. First, where the entity
collecting the information has official authority, and processing is essential for exercising this
authority. Second, where the controller does not have the authority, but a third party who has
474 Article 29 Data Protection Working Party, ‗Opinion 06/2014 on the notion of legitimate interests of the data
controller under Article 7 of Directive 95/46/EC‘, European Commission (9 April 2014), available at
http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2014/wp217_en.pdf,
(last accessed 28 October 2017).
475 Article 29 Data Protection Working Party, ‗Opinion 06/2014 on the notion of legitimate interests of the data
controller under Article 7 of Directive 95/46/EC‘, European Commission (9 April 2014), available at
http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2014/wp217_en.pdf,
(last accessed 28 October 2017).
476 Article 29 Data Protection Working Party, ‗Opinion 06/2014 on the notion of legitimate interests of the data
controller under Article 7 of Directive 95/46/EC‘, European Commission (9 April 2014), available at
http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2014/wp217_en.pdf,
(last accessed 28 October 2017).
477 Recital 31, EU GDPR.
101