GDPR Article 6(1)(e) Public Task Legal Basis

Under the GDPR, every instance of processing personal data needs a lawful basis under Article 6(1). Article 6(1)(e) — commonly shorthanded to ‘public task’ — is the basis most often used by public universities, public research institutes, and other publicly constituted research bodies, as an alternative to relying on consent under Article 6(1)(a) or legitimate interests under Article 6(1)(f).

The two-part test

Article 6(1)(e) applies where ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.’ Read alone, that wording could describe almost any research activity a public institution considers worthwhile. Article 6(3) closes that gap by requiring that the task actually be ‘laid down by Union law or Member State law to which the controller is subject’ — and that this legal basis meet an objective of public interest and be proportionate to the legitimate aim pursued. In practice this means a data protection officer assessing whether public task applies has to identify the specific statute, founding charter, or GDPR-implementing provision that establishes the institution’s research function as a public task, not simply assert that research is generally beneficial to society.

Because Member States retain discretion under Article 6(3) to legislate further conditions on this basis — who may process, for what purposes, subject to what safeguards, for how long — the exact operational requirements differ across EU/EEA jurisdictions and the UK. Institutions relying on public task typically need to document the specific national legal provision they are relying on as part of their Data Protection Impact Assessment or equivalent record of processing, alongside the separate Article 9(2)(j) and Article 89(1) safeguards that apply when the processing involves special category data (health, genetic, biometric data, and similar) for research purposes.

Why public research bodies prefer it over consent

Consent under Article 6(1)(a) must be freely given, specific, informed, and — critically — withdrawable by the data subject at any time, with no detriment for withdrawing. That combination sits awkwardly with several common research patterns: long-running cohort studies spanning years or decades, secondary analysis of archived datasets where re-contacting the original participants may be impossible or disproportionately burdensome, and large administrative or registry-based datasets where seeking individual consent from every data subject was never practical in the first place. If consent were the sole basis for such processing, a withdrawal partway through a study could force a controller to stop processing that person’s data going forward and, depending on the circumstances, complicate the integrity of pooled or longitudinal analysis. Public task does not carry this structural fragility — it is not something an individual data subject can unilaterally revoke in the way consent can be withdrawn, which is a large part of why public-sector research controllers gravitate toward it for large or long-duration datasets. This does not eliminate data subject rights: rights to object, access, rectification, and (subject to research-specific derogations under national law implementing Article 89) erasure can still apply, they are simply not exercised through consent-withdrawal mechanics.

Public task versus legitimate interests

Article 6(1)(f) legitimate interests is explicitly closed off to public authorities carrying out their tasks — the final sentence of Article 6(1) states that point (f) ‘shall not apply to processing carried out by public authorities in the performance of their tasks.’ This is why the choice for a public university or public research institute is not really public task versus legitimate interests as two interchangeable options; for the public-authority processing itself, legitimate interests is generally unavailable, making public task (where the Article 6(3) legal basis exists) the natural fit. Privately funded or private-sector research bodies face the opposite constraint: lacking official authority or a public-law task, they typically cannot invoke Article 6(1)(e) at all, and rely on consent or legitimate interests instead.

What this means in practice for research administrators

Relying on public task is not a default that avoids paperwork — it substitutes one documentation burden (identifying and citing the enabling law) for another (managing consent and withdrawal). Institutions still need a genuine, checkable answer to ‘what law establishes this as our public task,’ need to meet any further conditions that Member State law attaches to the basis, and still need to separately satisfy Article 9 and Article 89 requirements if special category data is involved. Getting the Article 6 lawful basis wrong — or failing to document it — is one of the more common gaps found in institutional data protection audits and DPIAs for research processing.