37
5455/16
VH/np
20
ANNEX
DGD 2C
EN
(34) In order to safeguard that consent has been freely-given, consent should not provide a valid
legal ground for the processing of personal data in a specific case, where there is a clear
imbalance between the data subject and the controller, in particular where the controller is a
public authority and this makes it unlikely that consent was given freely in all the
circumstances of that specific situation. Consent is presumed not to be freely given, if it does
not allow separate consent to be given to different data processing operations despite it is
appropriate in the individual case, or if the performance of a contract, including the provision
of a service is made dependent on the consent despite this is not necessary for such
performance.
(35) Processing should be lawful where it is necessary in the context of a contract or the intended
entering into a contract.
(35a) (…)
(36) Where processing is carried out in compliance with a legal obligation to which the controller
is subject or where processing is necessary for the performance of a task carried out in the
public interest or in the exercise of an official authority, the processing should have a basis in
Union law, or in the national law of a Member State. This Regulation does not require that a
specific law is necessary for each individual processing. A law as a basis for several
processing operations based on a legal obligation to which the controller is subject or where
processing is necessary for the performance of a task carried out in the public interest or in the
exercise of an official authority may be sufficient. It should be also for Union or Member
State law to determine the purpose of processing. Furthermore, this basis could specify the
general conditions of the Regulation governing the lawfulness of data processing, determine
specifications for determining the controller, the type of data which are subject to the
processing, the data subjects concerned, the entities to which the data may be disclosed, the
purpose limitations, the storage period and other measures to ensure lawful and fair
processing. It should also be for Union or Member State law to determine whether the
controller performing a task carried out in the public interest or in the exercise of official
authority should be a public authority or another natural or legal person governed by public
law, or by private law such as a professional association, where grounds of public interest so
justify including for health purposes, such as public health and social protection and the
management of health care services.