GDPR has the following lawful bases for processing data:
(d) vital interests: the processing is necessary to protect someone’s life.
This is one of the lawful bases that the school uses for processing data within GDPR. It is required as the school processes the personal data to protect someone’s life
This processing is necessary as without it the school would not be able to protect a person’s vital interests in any other less intrusive way. The school rely on this basis to store medical and special educational needs data to assist the school in protecting someone’s life.
Article 6 (1)(d) provides the lawful basis for processing where:
‘Processing is necessary in order to protect the vital interests of the data subject or of another natural person’
Recital 46 provides further guidance:
‘The processing of personal data should also be regarded as lawful where it is necessary to protect an interest which is essential for the life of the data subject or that of another natural person. Processing of personal data based on the vital interest of another natural person should in principal take place only where the processing cannot be manifestly based on another legal basis.’
This lawful basis generally only applies to matters of life and death. This is likely to be relevant for emergency medical care. While the school will use lawful basis (a) consent: the individual has given clear consent for you to process their personal data for a specific purpose, for the majority of its medical and special education needs processing. It may be required to use vital interests in the case of a life and death matter.