Section 70 amends Article 6 of the UK GDPR which is concerned with the lawful grounds for processing personal data. The section makes some clarifications to the public tasks lawful ground in Article 6(1)(e) and introduces a new lawful ground: new Article 6(1)(ea) of the UK GDPR. It also sets out examples of activities which may be in the legitimate interest of the data controller when relying on Article 6(1)(f).
	Article 6(1)(e) UK GDPR provides a lawful basis for processing where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Subsection (2)(a) makes it clear that the task carried out in the public interest referred to in A6(1)(e) must be that of the controller. This means that a controller cannot process personal data in reliance on another controller’s tasks carried out in the public interest under A6(1)(e). Section 8 of the DPA 2018 and regulation 41(7) of The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 provide additional clarity on the sorts of activities that constitute tasks carried out in the public interest for the purposes of Article 6(1)(e). These should be read consistently with these changes so that tasks arising from the activities are read as being those of the relevant controller.
	Subsection (2)(b) creates a new lawful ground for processing personal data by inserting new Article 6(1)(ea) into the UK GDPR. New Article 6(1)(ea) provides that processing will be lawful where it is necessary for the purposes of a recognised legitimate interest.
	Subsection (2)(c) prevents new Article 6(1)(ea) of the UK GDPR from being relied on by public authorities in the performance of their tasks, consistent with the existing restriction in respect of Article 6(1)(f) of the UK GDPR.
	Subsection (3) mirrors the amendments made by subsection (2)(a) by similarly restricting references to "tasks" in Article 6(3) UK GDPR to those of the controller.
	Subsection (4) inserts new paragraphs into Article 6 UK GDPR. New Article 6(5) defines processing necessary for a recognised legitimate interest for the purposes of new Article 6(1)(ea) as processing that meets a condition in new Annex 1 to the UK GDPR (inserted by subsection (64) and Schedule 4). Under new Article 6(6) to (10) the Secretary of State may make regulations to add to, vary or (in certain cases) omit recognised legitimate interest activities in Annex 1. Before laying regulations, the Secretary of State must have regard to the effects of any changes on the interests and fundamental rights and freedoms of data subjects, and the fact that children (where relevant) merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing. The Secretary of State can only add a new processing activity to Annex 1 if it is necessary to safeguard a public objective listed in Article 23(1)(c) to (j) of UK GDPR. The regulations must be made by statutory instrument and are subject to the affirmative procedure.
	New Article 6(11) sets out examples of activities which may constitute legitimate interests for the purposes of Article 6(1)(f) of the UK GDPR. Processing of personal data for these activities must be necessary, and the data controller is required to make sure that its interests in processing the data without consent are not outweighed by the individual’s rights and interests. The examples given in subsection (11) are illustrative only and non-exhaustive. Data controllers may rely on Article 6(1)(f) to process personal data for other legitimate activities, providing the processing is necessary for the activity and appropriate consideration is given to the potential impact of the processing on the rights and interests of data subjects. New Article 6(12) defines the meaning of "intra-group transmission" and "security of network and information systems", expressions used in subsection (11).
	Subsection (5) ensures that the right to object in Article 21 UK GDPR applies to new Article 6(1)(ea).
	Subsection (6) introduces Schedule 4, which inserts new Annex 1 into the UK GDPR. New Annex 1 to the UK GDPR lists those processing activities that will be regarded as ‘recognised legitimate interests’ for the purposes of the new lawful ground in Article 6(1)(ea).
	Subsection (7) removes the words "the controller’s" from section 8 of the DPA 2018 to improve the clarity of that provision.
	Subsections (8) and (9) set out minor and consequential amendments that are needed because of the creation of the new lawful ground in Article 6(1)(ea).
Part 5: Data Protection and Privacy Data protection principles Section 70: Lawfulness of processing