25. In order to be lawful, the processing of personal data should be necessary for compliance with a legal obligation to which the controller is subject, for the performance of a task carried out in the public interest by a competent authority based on law or in order to protect the vital interests of the data subject or of another person, or for the prevention of an immediate and serious threat to public security.
EDRi’s proposed amendment
25. In order to be lawful, the processing of personal data should be necessary for
Mirroring the proposed changes to Article 7 and the proposed new Article 7a, this recital should be adapted accordingly to clarify that all other reasons for processing should be seen as exceptions (which are further explained in the new recital 25a).