What is the legal basis for processing your personal data?

In the first instance your employer will rely on the following legal bases under the General Data Protection Regulation (GDPR) to provide your details to the local Health Board for it to offer you a vaccination:

•         Article 6(1)(c) – Processing is necessary for the compliance with a legal obligation (Health & Safety) to which the Controller is subject (your employer)
•      Article 6(1)(f) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.  A Legitimate Interests Test has been applied as part of a Data Protection Impact Assessment (DPIA) to confirm the application of this legal basis.

Once the Health Board has this information, then the legal basis it will use for processing your personal data for vaccination purposes under GDPR is:

•        Article 6(1)(e) – Task carried out in the public interest or in the exercise of official authority vested in the controller (the Health Board)

For special category data (health data) an additional legal basis is required and, in this case, there are two applicable:

•        Article 9(2)(h) Provision of preventative or occupational medicine, health or social care or treatment, or the management of health or social care systems
•       Article 9(2)(i) - Processing must be necessary for reasons of public interest in the area of public health (such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices)