Which statement correctly describes the use of vital interests as a basis for data processing under GDPR?

• A. A It is only used in emergencies to protect vital interests.
• B. B It is a valid basis for processing when the data subject cannot consent.
• C. C It is never used in financial institutions.
• D. D It requires explicit consent.

Answer: (B)

Vital interests allows processing when it’s necessary to protect someone’s life or safety, and the data subject cannot give consent. That’s why this statement is correct: if the person is unable to consent and there’s a risk to life or health, using this basis is appropriate because the priority is preventing harm. It isn’t limited to pure emergencies, but to situations where consent can’t be obtained and processing is needed to protect vital interests.

The idea that it’s never used in financial institutions isn’t accurate—FI contexts can involve protective processing in urgent situations. And this basis does not require explicit consent; consent is a separate basis for processing.