A municipal licensing office must maintain a statutory public register of license holders. Staff suggest relying on consent so individuals can "opt out" of the register. What is the better GDPR approach?
Select an answer to reveal the explanation.
Short Explanation
If the law says keep a register, do not pretend people can consent their way out of it. Legal obligation or public task is the honest basis. Consent that cannot truly be refused just confuses everyone.
Full Explanation
Where Union or Member State law requires a public body to process personal data for a statutory register, Article 6(1)(c) (legal obligation) and/or Article 6(1)(e) (public task) are typically the appropriate bases. Consent is often invalid or inappropriate when the processing is mandatory and refusal is not genuine. Public bodies remain within GDPR material scope when they process personal data, subject to applicable exemptions.