Comment by Hiopl

I don't understand how that passed.

> (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

What's the point of GDPR if you can side-step it in this way?