Collection Lawful basis When an organisation collects personal information, it should do so lawfully. Generally, a lawful basis would be: • You have obtained the person’s consent; • It is necessary for you to perform a task in the public interest as required by law as part of your official functions; • You have a legitimate interest and you use people’s data in ways they would reasonably expect and which have a minimal privacy impact; or • It is required to perform a contract or agreement you have with that person or to perform a service for that person. While every country will have its own legal framework, the above points are a good guide for NHRIs to use in asking what is the right thing to do, which can be different from what is permitted by the law in a given country. NHRIs should assign responsibility to a senior person in the organisation who will evaluate the potential harms and benefits whenever personal information is collected or used in a new way. This could be any person knowledgeable about the personal information and the level of risk involved for the HRDs. Legitimate interests of who? Under the GDPR, a “legitimate interest” is most likely to be an appropriate basis where an NHRI is using the personal information in ways that people – in this case, the individual HRD – would reasonably expect and that have a minimal impact. You must balance the NHRI’s interests against the individual’s interests. In particular, if they would not reasonably expect you to use data in that way, or it risks causing them harm, their interests are likely to override the organisational interests of the NHRI. Consent Consent is “any freely given, specific, informed and unambiguous indication of the person’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her” Data Protection Guidelines for NHRIs Toolkit 8