Skip to main content
Privacy Track
Category: Special Category Data

Public Health Interest

Simply put

Public health interest refers to the broad societal goal of protecting and improving the health of communities and populations, such as preventing the spread of disease and promoting general well-being. In a privacy context, it can be relevant where the processing of personal data may be justified by the need to serve these community-wide health objectives. The precise legal weight given to public health interest depends on the specific circumstances and applicable law, and any related data processing must still be assessed against the relevant legal requirements.

Formal definition

Public health interest denotes the objective of promoting and protecting the health of populations and communities through evidence-based, coordinated professional efforts to prevent disease and improve well-being. Under data protection law, invocations of a public health rationale for processing personal data must be grounded in an identified lawful basis rather than treated as a standalone justification; where special category (health) data is involved, an additional condition beyond the primary legal basis is generally required, and member state or national implementing law may impose specific safeguards or vary the position. The evidence provided describes public health as a field and objective but does not establish the specific GDPR provisions, conditions, or thresholds under which a public health interest may lawfully support processing, so practitioners should verify the applicable legal basis, supplementary conditions, and any relevant derogations against the current official text and regulator guidance.

Why it matters

Public health interest matters in a data protection context because the goal of protecting and improving community health can create pressure to collect, share, and analyse personal data at scale. The evidence describes public health as a science-based, evidence-backed field dedicated to protecting and improving the health of local and global communities through the coordinated efforts of many professionals. When those efforts involve identifiable individuals, however, the underlying societal objective does not by itself make the processing lawful; the activity must still be assessed against the applicable data protection requirements.

The practical significance lies in a common misconception: that invoking public health automatically authorises data processing. In fact, a public health rationale must be tied to an identified lawful basis, and where health data is involved an additional condition is generally required. Treating public health as a standalone justification risks non-compliant processing, particularly because national implementing law may impose specific safeguards or vary the position from one jurisdiction to another.

The evidence provided characterises public health as a field and objective but does not set out the specific legal provisions, conditions, or thresholds under which a public health interest may support processing of personal data. Practitioners should therefore treat the public health objective as a policy driver that must be reconciled with, rather than substituted for, the applicable legal framework, and should verify the relevant legal basis, supplementary conditions, and any derogations against the current official text and regulator guidance.

Who it's relevant to

Public health authorities and bodies
Organisations coordinating disease prevention and community health efforts, as described in the evidence, may seek to rely on a public health rationale for processing. They should ensure any such processing is grounded in an identified lawful basis and, for health data, an additional condition, rather than treating the public health objective as sufficient on its own. Applicable national implementing law and any specific safeguards should be verified.
Healthcare providers and professionals
The evidence characterises public health as the combined effort of many professionals promoting health and preventing disease. Where these activities involve identifiable individuals, providers should assess the processing against the relevant legal requirements and confirm the applicable conditions, which may vary by jurisdiction.
Data protection officers and compliance leads
DPOs advising on projects framed around a public health interest should scrutinise whether an appropriate lawful basis and, for special category health data, an additional condition have been identified. Because the applicable provisions and thresholds are not established by the evidence here, they should verify these against the current official text and regulator guidance and account for possible national divergence.
Researchers using population health data
Those conducting evidence-based public health research involving personal data should recognise that the public health objective supports but does not replace the need for a lawful basis and any additional conditions or safeguards. The precise position depends on applicable law and may differ across member states.

Inside Public Health Interest

Public interest in the area of public health
A concept referenced in the GDPR that can support certain processing of personal data and, where relevant, special category data, when such processing serves recognized public health objectives. The precise conditions depend on the applicable legal basis and, for special category data, an additional Article 9 condition, subject to assessment against the current official text.
Relationship to a legal basis under Article 6
Processing framed as being in the public health interest still requires an appropriate Article 6 legal basis. Depending on context this may typically be a public task or a legal obligation rather than consent; the correct basis should be identified case by case and not assumed to be consent.
Additional condition for special category data (Article 9)
Health data is generally special category data, so processing it requires an Article 9 condition in addition to an Article 6 basis. Certain conditions relating to public health may be available, but their scope can be shaped by member state or national implementing law and should be verified.
Dependence on member state and national law
The availability and limits of public-health-related processing can vary because member state derogations and national implementing measures may narrow or specify the conditions. The position under the UK GDPR and its implementing legislation may differ from the EU position.
Scope boundary
The concept concerns personal data of living individuals. It does not extend to anonymous data, and generally does not cover the data of deceased persons or legal entities, though national law may address some of these areas separately.

Common questions

Answers to the questions practitioners most commonly ask about Public Health Interest.

Does processing data for a public health purpose mean I do not need a legal basis under the GDPR?
No. A public health purpose does not remove the requirement for an Article 6 legal basis. You must still identify an appropriate basis, which in the public health context is often public task or legal obligation rather than consent, though the correct basis depends on the specific processing and the acting organisation. Where the data includes health information, this is special category data under Article 9 and requires a separate Article 9 condition in addition to the Article 6 basis. The precise conditions available, including those relating to public interest in the area of public health, may be shaped by member state or national implementing law, so verify the position in the relevant jurisdiction.
Is consent always the correct legal basis for processing personal data in the interest of public health?
Not typically. Consent is only one of the Article 6 bases and is frequently not the most suitable one for public health processing, particularly where a public authority is acting or where individuals cannot freely refuse without detriment. In many cases public task, legal obligation, or, for special category health data, a public health condition under Article 9 will be more appropriate. Treating consent as a universal requirement can create difficulties, because consent must generally be freely given and withdrawable. The right basis should be assessed case by case against the purpose, the actor, and applicable national law.
How do I document the legal basis when relying on a public health justification?
Document both the Article 6 basis and, where health or other special category data is involved, the corresponding Article 9 condition, together with any national law provision you are relying on. Record the specific public health purpose, the categories of data and data subjects, and the reasoning connecting the processing to that purpose. Because the availability and wording of public health conditions can vary by member state or under the UK GDPR and its implementing legislation, note the applicable law relied upon and keep the record aligned with the current official text, as these provisions can change.
When should a Data Protection Impact Assessment be carried out for public health processing?
A DPIA under Article 35 is generally required where processing is likely to result in a high risk to individuals, which is often the case for large scale processing of special category health data or systematic monitoring. Public health initiatives frequently fall into these higher risk categories, so a DPIA is commonly appropriate. The assessment should be completed before processing begins and should address necessity, proportionality, and mitigating measures. Consult any relevant supervisory authority lists of processing operations requiring a DPIA, as these can differ between regulators.
How can I apply data minimisation and safeguards to public health processing?
Limit the data to what is necessary for the stated public health purpose, and consider whether the purpose can be achieved with less identifiable data, for example through pseudonymisation or, where genuinely irreversible, anonymisation, noting that anonymous data generally falls outside the GDPR. Apply appropriate security and access controls, define retention periods tied to the purpose, and separate identifiers where feasible. The appropriate safeguards should be assessed against the risk and any conditions attached to the legal basis under national law, and revisited as the processing or guidance evolves.
How should personal data collected for a public health purpose be handled once that purpose ends?
Review whether continued processing remains necessary and compatible with the original public health purpose, and apply your defined retention limits so data is not kept longer than needed. Where onward use for archiving, scientific research, or statistical purposes is contemplated, assess whether it is compatible and whether additional safeguards apply. Any repurposing should be evaluated against the legal basis and any national law conditions relied upon, and the position should be verified against current guidance, since regulator expectations in this area can differ and may change.

Common misconceptions

A public health justification means consent is not needed and any processing is automatically lawful.
Public health interest is not a standalone permission. An appropriate Article 6 basis is still required, and for health data an additional Article 9 condition applies. Lawfulness remains context and risk dependent and is subject to assessment.
The public health interest condition is uniform across the EU and the UK.
The conditions can be shaped by member state derogations and national implementing law, and the UK GDPR position may diverge from the EU position. Practitioners should check the applicable jurisdiction's rules against the current official text.
Invoking public health interest removes the need for other GDPR safeguards.
Other obligations, such as transparency, data minimisation, security, and where applicable a Data Protection Impact Assessment under Article 35, generally continue to apply and are not displaced by a public health framing.

Best practices

Identify and document a specific Article 6 legal basis, and do not assume consent is the applicable basis for public health processing.
Where health data is involved, confirm and record an applicable Article 9 condition in addition to the Article 6 basis before processing.
Check the relevant member state or national implementing law, and consider whether the UK GDPR position differs, since public-health conditions can vary by jurisdiction.
Assess whether a Data Protection Impact Assessment under Article 35 is required, particularly for higher-risk or large-scale processing, and document the outcome.
Apply core principles such as data minimisation, transparency, and security, and confirm the processing genuinely concerns personal data of living individuals rather than anonymous data.
Verify the precise conditions and any relevant article references against the current official GDPR text and applicable regulator guidance, noting that positions may evolve.