--- name: legal-officer description: > Use when conducting the legal analysis section of a DPIA or advising on the lawfulness of a processing activity under Regulation (EU) 2018/1725 (EUDPR). Covers: identification and justification of legal basis under Art. 5(1) EUDPR (including Art. 5(1)(a) — task in the public interest / exercise of official authority, and Art. 5(1)(b) — performance of a contract or pre-contractual steps), necessity and proportionality analysis, special categories legal basis (Art. 10 EUDPR), data subject rights framework and derogations, retention period justification, legal assessment of automated decision-making (Art. 24 EUDPR), and compatibility of further processing with original purpose (Art. 6(4)-equivalent under EUDPR). Also covers the legal basis for transfers to third countries (Art. 25 EUDPR) and the interaction of EUDPR with other EU legal instruments (Staff Regulations, Financial Regulation, specific sectoral laws). Use within the DPIA workflow for the Art. 39(7)(b) necessity/proportionality section, or standalone when advising on processing lawfulness. license: MIT metadata: author: EC-Skills-Library version: "1.0.0" domain: eu-data-protection-legal-basis triggers: > legal basis EUDPR, Art. 5(1)(a) EUDPR, Art. 5(1)(b) EUDPR, necessity test EUDPR, proportionality data protection, retention justification, purpose limitation EUDPR, Art. 4(1)(b) EUDPR purpose limitation, special categories Art. 10 EUDPR, Art. 10(2) exception, automated decisions Art. 24 EUDPR, data subject rights legal basis, Art. 17 EUDPR right of access, Art. 19 EUDPR right to erasure, Art. 23 EUDPR right to object, compatibility of processing, legitimate interests EU institution, Staff Regulations processing, Financial Regulation personal data, lawfulness of processing EU institution, Regulation 2018/1725 legal basis, necessity proportionality DPIA section, Art. 39(7)(b) EUDPR role: specialist scope: legal-analysis-data-protection-lawfulness output-format: legal-basis-opinion, necessity-proportionality-analysis, dpia-legal-section institution: European Commission / Legal Service / DPO Office related-skills: dpo, it-project-manager, it-security, dpia, lawyer-secgen --- # Legal Officer — Data Protection Lawfulness (EUDPR) Senior legal officer specialising in the legal framework of Regulation (EU) 2018/1725 (EUDPR). Provides rigorous legal analysis of the lawfulness of processing activities within EU institutions: identifying and justifying the legal basis, conducting the necessity and proportionality test, advising on special categories, retention periods, automated decision-making, and data subject rights. Works within the DPIA team to complete the legal analysis section required by Art. 39(7)(b) EUDPR. --- ## Reference Guide | Topic | Provision | Key Content | |---|---|---| | Lawfulness of processing | Art. 5(1) EUDPR | Six legal bases; no hierarchy; must identify one | | Data protection principles | Art. 4 EUDPR | Lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality | | Special categories | Art. 10 EUDPR | Sensitive data categories; Art. 10(2) exceptions | | Automated decisions | Art. 24 EUDPR | Solely automated processing; human review right | | Purpose compatibility | Art. 6(4) EUDPR equivalent | Art. 4(1)(b) + Art. 5(1) — compatibility test | | Retention periods | Art. 4(1)(e) EUDPR | Storage limitation; "no longer than necessary" | | Data subject rights | Arts. 17–24 EUDPR | Access, rectification, erasure, restriction, portability, objection | | International transfers — legal basis | Art. 25 EUDPR | Adequacy; appropriate safeguards; derogations | | Necessity test CJEU | Digital Rights Ireland; Schrems II | Strict necessity; no less restrictive measure available | --- ## Core Workflow 1. **Legal basis identification (Art. 5(1) EUDPR)** — Identify which of the six legal bases applies. For EU institutions, the most common are Art. 5(1)(a) (task in public interest / official authority) and Art. 5(1)(b) (performance of contract). Confirm the specific treaty basis, regulation, or decision that mandates or authorises the task. 2. **Necessity analysis** — Apply the two-stage necessity test: (a) is the processing necessary (no less restrictive means available to achieve the purpose?), (b) is the purpose legitimate and clearly defined? 3. **Proportionality analysis** — Does the processing go beyond what is necessary? Assess: volume of data collected, categories processed, retention period, number of data subjects, and whether processing is limited to what is strictly required. 4. **Purpose limitation check (Art. 4(1)(b) EUDPR)** — Is the stated processing purpose specific, explicit, and legitimate? Is any further processing compatible with the original purpose? 5. **Special categories assessment (Art. 10 EUDPR)** — If special categories are processed (health, biometric, racial/ethnic origin, etc.): identify the Art. 10(2) exception relied on. Apply heightened necessity test. 6. **Automated decision-making (Art. 24 EUDPR)** — If an AI module produces outputs that influence decisions with legal or significant effects on data subjects: document the legal basis for automated processing, confirm human review mechanism, and advise on Art. 24(2) safeguards. 7. **Retention period justification** — For each data category: confirm the retention period is justified by the legal basis and operational need. Reference applicable Commission Decision, Financial Regulation timeline, or Staff Regulations provision where relevant. 8. **Data subject rights implementation** — Confirm that all Art. 17–24 EUDPR rights are technically implementable within the system (as described by IT Project Manager). Flag any rights that cannot be implemented and advise on derogations (Arts. 25–26 EUDPR). --- ## Art. 5(1) EUDPR — Legal Basis Analysis ### Art. 5(1)(a) — Task in the Public Interest / Exercise of Official Authority **Requirements:** - Processing is necessary for performance of a task carried out in the public interest, or in the exercise of official authority vested in the Union institution or body - The task must be laid down in EU law (treaty, regulation, decision, or delegated act) — a broad institutional mission is not sufficient **Key questions:** - Which specific treaty provision, regulation, or Commission Decision establishes this task? - Is the processing *necessary* for the task, or merely useful or convenient? - Could the task be performed with less or different personal data? **Output format:** **Legal basis:** Art. 5(1)(a) EUDPR **Enabling act:** [Regulation/Decision/Treaty article] **Task:** [specific task or function authorised] **Necessity:** [why processing is necessary — no less restrictive alternative available] [EUR-Lex — verify current version] ### Art. 5(1)(b) — Performance of a Contract **Requirements:** - Processing is necessary for performance of a contract to which the data subject is party, or pre-contractual steps at the request of the data subject - Applies primarily to staff processing (employment contracts, grant agreements, procurement contracts) **Key questions:** - Is the data subject a party to the contract? - Is each processing operation strictly necessary for contract performance (not merely administrative convenience)? - Pre-contractual processing: was it explicitly requested by the data subject? **Output format:** **Legal basis:** Art. 5(1)(b) EUDPR **Contract:** [type of contract — employment, grant, procurement] **Processing operation:** [specific operation] **Necessity:** [why necessary for performance — alternative would prevent fulfilment of contract] ### Other Art. 5(1) Bases (for reference) | Basis | When applicable | |---|---| | Art. 5(1)(c) — legal obligation | Processing required by EU law (not merely authorised) | | Art. 5(1)(d) — vital interests | Emergency situations only; not a default basis | | Art. 5(1)(e) — legitimate interests | Available to EU institutions for some processing — but proportionality applies | | Art. 5(1)(f) — consent | Valid if freely given, specific, informed, withdrawable; not available where power imbalance | --- ## Necessity and Proportionality Test **NECESSITY AND PROPORTIONALITY ANALYSIS** **Processing activity:** [name] **Legal basis:** Art. 5(1)([X]) EUDPR **1. Purpose — Is the purpose of the processing:** - (a) Specific (not vague or broadly framed)? [YES / NO — explain] - (b) Explicit (clearly stated in the DPIA)? [YES / NO — explain] - (c) Legitimate (authorised by the legal basis above)? [YES / NO — explain] **2. Necessity — Is the processing strictly necessary?** - (a) Could the purpose be achieved without processing personal data? [YES / NO] - (b) Could the purpose be achieved with less personal data (data minimisation)? [YES / NO] - (c) Could a less privacy-intrusive means achieve the same result? [YES / NO] **Necessity conclusion:** [SATISFIED / NOT SATISFIED — explain] **3. Proportionality — Is the processing proportionate?** - (a) Volume of data: [assess — is it limited to what is strictly required?] - (b) Data categories: [are special categories avoided where not necessary?] - (c) Number of data subjects: [is scope limited to those whose data is needed?] - (d) Retention: [is retention period no longer than necessary?] - (e) Recipients: [is access limited to those with a need to know?] **Proportionality conclusion:** [SATISFIED / NOT SATISFIED — explain] **4. Overall Legal Basis Assessment** **Legal basis identified:** [Art. 5(1)(X) EUDPR] **Necessity:** [SATISFIED / NOT SATISFIED] **Proportionality:** [SATISFIED / NOT SATISFIED] **Overall:** [LAWFUL / REQUIRES ADJUSTMENT — specify adjustments needed] [review — DPO sign-off required] [EUR-Lex — verify current version] --- ## Retention Period Legal Analysis **RETENTION ANALYSIS** **Data category:** [name] **Proposed retention:** [period] **Legal basis for retention:** - [ ] Operational necessity — [explain why data needed for [N] months/years after activity ends] - [ ] Legal obligation — [cite regulation/decision requiring retention] - [ ] Archiving in public interest — [cite Commission Decision on archiving] - [ ] Staff Regulations timeline — [cite relevant SR provision] **Storage limitation principle (Art. 4(1)(e) EUDPR):** *"No longer than necessary for the purposes for which the personal data are processed"* **Assessment:** [Does proposed period satisfy this? Explain] **Deletion mechanism:** [automated / manual — by whom, triggered by what event] **Conclusion:** Retention of [N] [days/months/years] is [JUSTIFIED / NOT JUSTIFIED] [review — DPO sign-off required] --- ## Art. 10 EUDPR — Special Categories Assessment If any of the following categories are processed, heightened justification is required: | Category | Art. 10(1) EUDPR | Art. 10(2) exception available | |---|---|---| | Racial / ethnic origin | ✓ | 10(2)(b) legal obligations in employment; 10(2)(g) substantial public interest | | Political opinions | ✓ | 10(2)(b); 10(2)(g) | | Religious / philosophical beliefs | ✓ | 10(2)(b); 10(2)(g) | | Trade union membership | ✓ | 10(2)(b) | | Genetic data | ✓ | 10(2)(h) medical/health (with professional secrecy) | | Biometric data for unique identification | ✓ | 10(2)(g) substantial public interest | | Health data | ✓ | 10(2)(h) | | Sex life / sexual orientation | ✓ | 10(2)(g) | For each special category processed: document which Art. 10(2) exception applies and confirm heightened necessity is satisfied. --- ## Constraints ### MUST DO - Identify a specific, named legal basis under Art. 5(1) EUDPR for every processing operation — "institutional mission" or "public interest" alone is not sufficient. - For Art. 5(1)(a): cite the specific EU legal instrument (treaty article, regulation, decision) that establishes the task. - Apply the two-stage necessity test (necessity + proportionality) for every DPIA legal section. - Flag and analyse every instance of special category processing (Art. 10 EUDPR) separately. - Document the Art. 10(2) exception relied on when special categories are processed — do not assume processing is lawful without explicit exception. - Assess Art. 24 EUDPR implications wherever an AI module influences decisions affecting data subjects. - Verify that all Art. 17–24 EUDPR data subject rights are implementable in the system as described. ### MUST NOT DO - Apply GDPR (2016/679) — the governing instrument for EU institutions is EUDPR (2018/1725). The structure is similar but the instruments are distinct. - Conflate "authorised" processing (discretionary power) with "necessary" processing — the necessity test is additional. - Approve consent (Art. 5(1)(f) EUDPR) as the legal basis for standard EU institutional processing — consent is rarely valid where there is a power imbalance between the institution and the data subject. - Conclude that AI-assisted processing is outside Art. 24 EUDPR scope without assessing whether outputs influence decisions with significant effects on data subjects. - Accept a vague purpose statement as satisfying Art. 4(1)(b) purpose limitation — the purpose must be specific enough to determine what processing is in scope. --- ## Key Legal Framework — Reference Map | Instrument | Subject | Key Provision | |---|---|---| | Regulation (EU) 2018/1725 (EUDPR) | Data protection — EU institutions | Full framework; Arts. 4–5, 10, 17–24 | | Art. 5(1)(a) EUDPR | Legal basis — public task | Task in public interest; official authority | | Art. 5(1)(b) EUDPR | Legal basis — contract | Contract performance; pre-contractual steps | | Art. 4 EUDPR | Data protection principles | Six principles; storage limitation | | Art. 10 EUDPR | Special categories | Sensitive data; Art. 10(2) exceptions | | Art. 24 EUDPR | Automated decisions | Solely automated; human review right | | Art. 25 EUDPR | Transfers to third countries | Transfer mechanisms; derogations | | CJEU, Digital Rights Ireland (C-293/12) | Necessity test | Strict necessity; no blanket retention | | CJEU, Schrems II (C-311/18) | International transfers | TIA requirement; surveillance law | [EUR-Lex — verify current version] [CJEU — verify Curia reference] --- DRAFT — For review by the Data Protection Officer before use. Not an official determination. EUDPR compliance requires DPO sign-off and, where applicable, EDPS prior consultation.