Page 1

PERSONAL DATA PROTECTION OFFICE OF THE SLOVAK REPUBLIC
Hraničná 12, 820 07 Bratislava 27
_______________________________________________________________________________
no. 00204/2018-Op-2
Methodological guideline no. 2/2018
Legality of processing
Updated version from 22.01.2019
According to § 81 par. 2 letter d) of Act no. 18/2018 Coll. Office for Personal Data Protection
Of the Slovak Republic (hereinafter referred to as the "Office") issues this methodological guideline.
INTRODUCTION
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on protection
natural persons in the processing of personal data and on the free movement of such data, to which
Directive 95/46 / EC (General Data Protection Regulation) (hereinafter referred to as "the Data Protection Regulation") is repealed
"Regulation") regulates the principles of personal data processing in Art. 5 par. 1. In Act no.
18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts (hereinafter referred to as
,, Act no. 18/2018 Coll. ”), The principles of processing are reflected in the provisions of § 6 to § 12.
These basic principles in principle reflect the current legislation on the protection of personal data
data, while Regulation and Act no. 18/2018 Coll. the individual principles specify and determine
more specific rules for operators. The principles cut across the whole Regulation and
Act no. 18/2018 Coll. and affect the interpretation of individual provisions as well as their correctness
application.
Legality can be described as one of the most important principles of personal protection
data. This principle expresses and contains the condition that the processing of personal data is
lawful only if and only to the extent that at least one of the conditions under Art. 6
par. 1 Regulations / § 13 par. 1 of Act no. 18/2018 Coll.
The principle of legality also expresses the requirement for fair and lawful processing, which
means that the processing must not contradict (must be consistent) not only with itself
Regulation / Act no. 18/2018 Coll., But must be in accordance with the law of the Union, the law of the member
state and good morals, so as not to violate the fundamental rights and freedoms of the persons concerned,
in particular, the violation of their right to the preservation of human dignity or other unjustified ones
encroaching on her right to privacy. Following this, legislation is needed
protection of personal data must always be perceived as a general legal regulation - lex generalis.
Art. 5 par. 1 letter (a) Regulations
Personal data must be processed lawfully, fairly and transparently in
relationship with the data subject ("legality, fairness and transparency").

1

Page 2

§ 6 of Act no. 18/2018 Coll .
Personal data may only be processed lawfully and in such a way that no breach occurs
fundamental rights of the person concerned.

1.1 What is the legal basis for the processing of personal data?
The controller must have at his disposal for each purpose of personal data processing
appropriate legal basis in accordance with Art. 6 par. 1 Regulations / § 13 par. 1 of Act no. 18/2018
Coll., Which defines the conditions under which processing is lawful. Legal basis
from a personal data protection point of view, we understand the reason that allows the operator
carry out individual processing operations with the personal data of the data subjects (eg
legitimate interest of the operator in the protection of his property, Act no. 311/2001 Coll.
Labor Code as amended). Personal data may be processed by the controller
for different purposes, and must have an appropriate / adequate legal basis for each such purpose.
On what basis do I perform processing? Based on consent, contract, law,
legitimate interest ...?
The controller is obliged to determine the legal basis before the start of processing and may
choose any of the legal bases if it meets the conditions defined for it. However, it must
consider the legal consequences of determining a specific legal basis, which means the operator
it must take care to adapt its use to the specific processing activity and to its own
own environment.
1.2 Legality of data processing
The principle of legality is further specified in particular in Art. 6 Regulations / § 13 of the Act
no. 18/2018 Coll. This provision exhaustively lists the conditions under which processing takes place
legal:
a) the consent of the data subject to the processing of personal data,
(b) processing is necessary for the performance of a contract to which it is a party
person, or in the context of pre-contractual relations,
c) processing is necessary to fulfill the legal obligation 1 of the operator,
(d) processing is necessary in order to protect the vital interests of the data subject
or another natural person,
(e) processing is necessary for the performance of a task carried out in the public interest; or
exercise of trust,
(f) the legitimate interest of the operator or a third party.

In the context of § 13 par. 1 letter c) of Act no. 18/2018 Coll. processing is lawful if provided for by special
a regulation or international agreement by which the Slovak Republic is bound.
1

2

Page 3

Operators whose activities are covered by the legislation of the Regulation should not
to omit that in the 4th part of Act no. 18/2018 Coll., Which is binding for all entities are
regulated special situations of lawful processing, which are based on authorizing officers
the provisions of the Regulation under which Member States had the option of maintaining in force,
or, conversely, to introduce more specific provisions in order to indicate the right to protection
personal data in accordance with the specifications, characteristic of the legal system, whether
already in the area of ​freedom of expression and the right to information, processing of personal data of employees
and so on. Provisions of § 78 of Act no. 18/2018 Coll. do not constitute separate legal bases
processing, but regulate the conditions, resp. assumptions under which processing is lawful.
1.3 Three types of personal data
• general (current) personal data (eg name, surname, birth number),
• special categories of personal data, which are exhaustively defined in Art. 9 par. 1
Regulations / § 16 par. 1 of Act no. 18/2018 Coll. For a special category of personal data
according to the new personal data protection legislation, the birth number is no longer considered , but
enjoys the same legal protection, including a ban on the publication of a personal identification number, p
unless the person concerned publishes his or her personal identification number and also a photograph ,
unless it is made for the purpose of processing a specific category of personal data,
does not consider as an indication of a special category,
• personal data relating to the admission of guilt for criminal offenses and misdemeanors.
In the case of the processing of a specific category of personal data, it is necessary to state that they
processing is generally prohibited unless one of the conditions set out in
Art. 9 par. 2 Regulations / § 16 par. 2 of Act no. 18/2018 Coll., For which the processing is special
categories of personal data are allowed , the controller not forgetting that for
the processing itself must also have an adequate legal basis in accordance with Art. 6
par. 1 Regulations / 13 par. 1 of Act no. 18/2018 Coll.
In other words, under the new legislation, the condition must first be met
according to Art. 9 par. 2 Regulations / § 16 par. 2 of Act no. 18/2018 Coll., Which excludes processing from
prohibition referred to in Article 9 par. 1 of the Regulation / § 16 par. 1 of Act no. 18/2018 Coll. and only subsequently
meet the condition under Art. 6 par. 1 Regulations / § 13 par. 1 of Act no. 18/2018 Coll. (legality
processing in the context of having an appropriate and proportionate legal basis).
2. Consent
Consent to the processing of personal data must be given freely and must be
concrete, informed, unambiguous and demonstrable. 2 The conditions for granting consent are
further specified in Art. 7 of the Regulation / § 14 of Act no. 18/2018 Coll. So that consent can be

Closer to this legal basis - Guideline of the WP Working Group 29 on consent under the Regulation,
available at: https://dataprotection.gov.sk/uoou/sites/default/files/usmernenia_k_suhlasu.pdf
2

3

Page 4

considered to be a valid legal basis for processing should be specific and informed
an indication of the wishes of the person concerned. Used properly, consent is a tool that
provides the data subject with control over the processing of his data. If used incorrectly,
the control is apparent and the consent constitutes an inappropriate legal basis for processing. In the meaning
The above-mentioned legal consequences of choosing a legal basis are needed in this
state in the context that the person concerned has the right to withdraw the consent at any time and before granting
consent, the person concerned must be informed of this right .
The method of obtaining consent and proof of its granting is at the discretion of the operator;
the Office closely monitors the line of rights of the persons concerned, ie the right to agree and disagree, as well as the right
not be discriminated against in relation to non-consent.
In this context, the term explicit consent , used for example in
processing of a specific category of personal data, or in the case of consent to the processing
birth number (provided that consent is an appropriate legal basis). From a legal point of view
express consent means the consent expressed. Any consent to processing must be
free, concrete, informed and unambiguous expression of the will of the person concerned, in what form
statements ; or a clear confirmation action (such as uploading a photo to
web interface to the data subject), consents to the processing of personal data , which already
but cannot be considered as explicit consent. It can therefore be assumed that the key
the difference between ordinary and express consent is the way in which consent is expressed.
Consent that can be deduced from the proceedings in question is not considered to be explicit consent
persons. Explicit consent must be given by a declaration from the person concerned. Most often
provided by an unambiguous written statement of the person concerned by the person concerned
sign and agrees to the processing of personal data of a specific category into a specific
purpose. However, this is not the only way to prove its acquisition, it can be such a way
providing explicit consent by filling in the electronic form, sending
an email with an electronic signature or a scan of the statement along with the signature.
The so-called two-phase verification.
Example: An operator sends an e-mail to the person concerned that he intends to process medical treatment
records and, if the person concerned agrees, should send a reply to the operator
"I agree", and then the operator verifies this fact by SMS - sending
verification code to confirm consent.
In application practice, the Office often encounters misuse of consent , in particular
in situations where a special law directly imposes on the person concerned the obligation to provide personal
data to a legally defined entity. In such a case, the person concerned should not have been granted
the right to decide on the processing of her personal data. Similarly, in the case of obtaining consent to
processing of personal data for the purpose of concluding and fulfilling the contract. Obtaining consent
the person concerned is redundant in such cases and confused for the person concerned, as
the controller has another relevant legal basis for the processing in question,
the use of which is likely to be invoked after the consent of the person concerned has been revoked.
4

Page 5

The Authority is of the opinion that the above conduct of the operators has, inter alia, the effect
false information to the persons concerned of the right to withdraw consent pursuant to Art. 7 par. 3
Regulations / § 14 par. 3 of Act no. 18/2018 Coll., As well as insufficient legal fulfillment
information obligation according to Art. 13 or 14 of the Regulation / § 19 or 20 of Act no. 18/2018 Coll.
We reiterate that it is the duty of the operator to establish personal processing
data on an appropriate legal basis so that the processing meets the requirements of lawfulness.
3. Contract
The controller processes personal data without the consent of the data subject, if the processing
personal data is necessary for the performance of the contract in which the data subject acts as
one of the parties, or to take action before the conclusion of the contract on the basis of
at the request of the person concerned, ie in the context of pre-contractual relations. The provisions of Art. 6 par. 1 letter
b) Regulations / § 13 par. 1 letter b) of Act no. 18/2018 Coll. needs to be interpreted strictly, does not
apply to situations where processing is not actually necessary for the performance of the contract. That
means, for example, in the case of an employment contract, the necessity of processing is assessed
personal data of the persons concerned in order for the contracting parties to fulfill the obligations
contracts.
4. Legal obligation
According to Art. 6 par. 1 letter c) Processing is lawful only if and only in that
to the extent necessary to fulfill the legal obligation 3 of the operator. It is currently
it is necessary to interpret the provision in question in the light of the opinion of the European Commission, which
takes the view that this legal basis for the processing of personal data may be
to be used only in the case of a legal obligation, not an authorization or an option enshrined in
of law. In special legal regulations, processing is defined by the command
form, as a legal obligation, expressed for example: the operator is obliged to process
name, surname ..., the operator processes the name, surname ..., medical documentation
It contains ... .
Example of a legal obligation: According to § 99 of Act no. 311/2001 Coll. Labour Code,
the employer is obliged to keep records of working time, overtime work, night work,
the active part and the inactive part of the employee's on-call time so that it is recorded
the beginning and end of the period in which the employee was performing work or was ordered to do so
or agreed on-call time. During the secondment, the employer leads
records according to the first sentence at the place of work of the temporarily assigned employee.
Example of a legal obligation: According to § 20 par. 4, first sentence of Act no. 245/2008 Coll. about education
and education (School Act) and on the amendment of some laws, primary school requires

In the context of § 13 par. 1 letter c) of Act no. 18/2018 Coll., Ie in the case of processing activities that do not fall
under European Union law, processing is lawful if a special regulation or an international agreement so provides,
by which the Slovak Republic is bound.
3

5

Page 6

when registering a child for the fulfillment of compulsory school attendance, personal data according to § 11 par. 6 letter
(a) the first to sixth points and point b).
In the conditions of the legal order of the Slovak Republic, it is in special legal
regulations often process the processing of personal data defined as an option, not as lawful
duty. Operators whose processing is necessary to comply with the law
options or authorizations, they will have to find another appropriate legal basis, in particular perhaps in this one
context to talk about the performance of a task carried out in the public interest or in the exercise of public
powers pursuant to Article 6 (1) 1 letter e) Regulation 4 , or the legitimate interest of the operator
within the meaning of Art. 6 par. 1 letter f) Regulations. As the legislature itself assumes that
processing is lawful, a test of proportionality, which is in the use of the legal basis
legitimate interest is a mandatory requirement, operators will find it easier to
Example of a legal possibility: According to § 9 par. 1, first sentence, of the Act of the National Council of the Slovak Republic no. 182/1993 Coll. about
ownership of flats and non-residential premises, the administrator or the community is entitled for the purposes
house administration to process personal data of owners of flats and non - residential premises in the house in
range name, surname, date of birth, birth number, permanent or temporary address
residence, apartment number, telephone number, e-mail address, account number and bank code.
Example of a legal possibility: According to § 13 par. 4 of Act no. 311/2001 Coll . Labour Code,
the employer may not, without serious grounds based on the specific nature of the activities
involve the employee’s privacy in the workplace and in common areas
employer, by monitoring him, records telephone calls
carried out by the employer's technical work equipment and inspects
e-mail sent from and delivered to the work e-mail address without
to warn him in advance. In this case, the introduction of control
considered a legal obligation of the operator, its introduction is a justification
employer.
5. Vital interest
The processing of personal data is considered lawful, even if necessary for the purposes
protection of an interest which is fundamental to the life of the person concerned and contrary to the previous legal one
regulation of personal data protection of another natural person. With reference to the relevant recital 46
Regulations, processing of personal data on the basis of vital interest should be
carried out only in exceptional cases, in principle only if such processing takes place
cannot be based on any other legal basis. An example is the use of this legal instrument
basis in the case of the processing of personal data of victims or participants in an accident, when
consent to processing cannot be obtained objectively. Obligation to obtain additional consent
after the person concerned or another natural person is able to provide it, it falls away. Into account
the use of this legal basis comes even if the processing is necessary for

4

See further in the methodological guideline - p. 6

6

Page 7

humanitarian purposes, including monitoring epidemics and their spread, or in humanitarian
emergency situations.
6. Public interest
Processing is also lawful if it is necessary to fulfill the task carried out in
in the public interest or in the exercise of official authority conferred on the operator. Public interest
is an interest that is of general interest, that is, it is intended to serve the benefit of the majority of citizens.
As in the case of the processing of personal data, if this is necessary for compliance
legal obligation of the operator, according to Art. 6 par. 3 Regulations basis for processing
must be determined:
(a) in Union law; or
(b) in the law of the Member State applicable to the operator.
The concept of Union law or the law of a Member State is not legally defined, but a recital
41 of the Regulation states that where reference is made in this Regulation to a legal basis or
legislative measure, this does not necessarily require a legislative act to be adopted
Parliament, without prejudice to constitutional requirements
the law of a Member State. Based on the provisions of Art. 13 par. 1 of the Slovak Constitution
Republic, pursuant to which obligations may be imposed by law or on the basis of law , v
within its limits and while preserving fundamental rights and freedoms, by an international agreement pursuant to Art.
7 par. 4, which directly establishes the rights and obligations of natural or legal persons, or
by government regulation pursuant to Art. 120 par. 2, the basis for processing should be laid down
in any of the above legal norms. The law in question also determines the purpose of the processing , which
it must be sufficiently clear and precise to enable the processing of personal data for the data subject
predictable.
In the case of the legal basis under Art. 6 par. 1 letter c) The regulation is processing
personal data is explicitly enshrined as a legal obligation of the controller. If it goes
o legal basis of public interest, the operator is given to perform a certain role in
public interest, and it is clear that this task cannot be done without processing
personal data.
Example: Monitoring of premises accessible to the public by the municipality. Municipality according to the law
no. 369/1990 Coll. on general establishment, as amended, in the exercise of self-government
ensures public order in the village. At the same time, it is clear that the fulfillment of this task cannot be done without
processing of personal data, even if it does not directly formally regulate the provision of the law
processing of personal data. Crucially, the purpose for which the operator processes
personal data is in accordance with its tasks imposed on it by a specific generally binding legal
prescription. The municipality can therefore use it as legal when monitoring premises accessible to the public
basis for processing the public interest in ensuring public order in accordance with Art. 6 par.
1 letter e) Regulations.
7

Page 8

If the operator chooses this legal basis, he is not obliged to perform the test
proportionality, as in the case of a legitimate interest. However, the person concerned has against
processing the right to object. When choosing this legal basis, the operator must know
in accordance with the principle of accountability, to demonstrate the importance of the public
interest resp. what role was entrusted to him in the exercise of official authority, as well as that legal basis
for processing is laid down in Union or Member State law. Necessity
processing of personal data in the public interest or in the exercise of public authority entrusted to it
to the operator, the Authority shall assess it in accordance with the basic principles of processing.
7. Legitimate interest
The processing of personal data is lawful even if it is necessary for the purpose
the legitimate interests of the operator or of a third party, except where such
interests outweigh the interests or rights of the data subject requiring the protection of personal data
data, in particular if the data subject is a child. This legal basis is required
performing a proportionality test before the actual processing of personal data begins
data and which assumes cumulative fulfillment in its three-step test
conditions, after the first pursuit of a legitimate interest of the operator or a third party,
secondly, the necessity of processing personal data for the realization of the monitored legitimate one
interest and , thirdly, the condition that the fundamental rights and freedoms of the person
data protection concerns the interest of the controller or a third party 5 .
Three steps of the proportionality test:
1. Identify a legitimate interest
2. Perform a necessity test
3. Perform a comparison test
The result of the proportionality test will determine whether the legitimate interest of the operator
exceeds the rights and freedoms of the persons concerned and whether it can be
legal basis for processing. The legitimate interest of the operator may be
for example direct marketing and other forms of marketing or advertising, protection of property
monitoring the premises with a camera system, keeping records of visits at the entrance to the
buildings and more.
The legal basis of the legitimate interest does not apply to processing by public authorities
power in the performance of their tasks assigned to them by law, as its use would be a public authority
extended the legal basis established for them. For the processing of personal data carried out
public authorities, in the performance of their tasks, a legal basis under Article 6 is possible
par. 1 letter c) Regulations / § 13 par. 1 letter c) of Act no. 18/2018 Coll. or legal basis
pursuant to Article 6 (1) 1 letter e) Regulations / § 13 par. 1 letter e) of Act no. 18/2018 Coll. That, however

5

For more details, see the judgment of the CJEU in Case C-13/16, 4 May 2017, paragraph 28

8

Page 9

does not preclude the possibility for a public authority to apply a legal basis of legitimate interest to
processing which it does not perform in the performance of its tasks, for example in the case of a municipality which
monitors the premises of the town hall building in order to protect property, school publishing
photographs of pupils in the interior of the school (on the notice board) and the like.
8. Compatibility test
In Art. 6 par. 4 of Regulation 6 provides that if processing for purposes other than those for
which personal data have been collected is not based on the consent of the data subject or on the law
Union or of a Member State which constitutes a necessary and proportionate measure in
democratic society to protect the objectives set out in Article 23 (1). 1, the operator of
ascertaining whether processing for another purpose is compatible with the purpose for which the personal data were made
originally obtained shall take into account, inter alia:
(a) any link between the purpose for which the personal data were originally obtained and the purpose
intended further processing of personal data,
(b) the circumstances in which the personal data were obtained, in particular those relating to the relationship between
the person concerned and the operator,
(c) the nature of the personal data, in particular whether specific categories of personal data are processed
or personal data relating to the conviction of a criminal offense; or
offense,
(d) the possible consequences of the intended further processing of personal data for the data subject
person
(e) the existence of adequate safeguards , which may include encryption or pseudonymisation.
The provisions of Art. 6 par. 4 of the Regulation constitutes an exception to the purpose limitation principle
within the processing operations of the same operator. This provision is not
a separate legal basis, ie the operator must have / has
appropriate legal basis in accordance with Art. 6 par. 1 Regulations, for example, handle personal
data on the basis of a contract with the data subject. Legal basis for further processing, if
the result of the compatibility test is positive, the contract will continue. The operator will be
process personal data for both the original and the new, compatible purpose.
The subject of the compatibility test, resp. compatibility is to determine whether the operator
the new processing purpose established is compatible with the original processing purpose for which they were used
personal data obtained. Only on the basis of a positive result of the compatibility test can
the controller to process personal data for a purpose other than the original one, for
who obtained the personal data.
Example: In the case of an operator who has a legal claim against the debtor, for
the processing of the personal data of the data subject for the purpose of asserting a legal claim remains
the original legal basis on which he processed the personal data for the original purpose (for example,

6

In Act no. 18/2018 Coll. the compatibility test is reflected in the provision of § 13 par. 3

9

Page 10

contract) is maintained, and thus there is only a change of purpose / partial modification in accordance with Art. 6
par. 4 Regulations / § 13 par. 3 of Act no. 18/2018 Coll., After performing a compatibility test.

In Bratislava, on August 2, 2018
In Bratislava on January 22, 2019

Soňa Pőtheová
President of the Office

10

