You need a lawful basis to process data. Two of the most ostensibly straightforward are legal obligation (here’s something you have to do) and “public task” (here’s something you have the legal power to do). Because the UK legal system is screwy, with multiple jurisdictions and sources of legal authority (statute, common law, a piece of paper that a Royal gave your predecessors after losing a bet), things are not quite as simple as they appear. But it is possible to disentangle it all.

There is no such thing as “public task”: the lawful basis comprises two distinct elements. The first is the exercise of official authority and the second is a task carried out in the public interest. They’re not the same thing, but in both cases, you need to trace back to some source of legal authority. The law can tell you specifically DO THIS THING WITH PERSONAL DATA, or it can say DO THIS THING (which you can’t do without personal data) or even EXERCISE YOUR DISCRETION IF YOU FEEL LIKE IT (with personal data). They all nestle under the same umbrella, and in this short and entertaining video, I will unpack how it all works.