Peter Puškár v Finančné riaditeľstvo Slovenskej republiky and Kriminálny úrad finančnej správy

Lawful basis (in general): Subject to the exceptions permitted under Article 13 of the Data Protection Directive, all processing of personal data must comply, first, with the principles relating to data quality (in Article 6 of that directive) and, have lawful basis (by complying with one criteria for making data processing legitimate listed in Article 7 of that directive) (see, Bara). The list of lawful basis in Article 7 is an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful (see ASNEF). (¶104–105)

In accordance with the provisions of Chapter II of Directive 95/46, entitled ‘General rules on the lawfulness of the processing of personal data’, subject to the exceptions permitted under Article 13 of that directive, all processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of the directive and, secondly, with one of the criteria for making data processing legitimate listed in Article 7 of that directive (see, to that effect, judgment of 1 October 2015, Bara and Others, C‑201/14, EU:C:2015:638, paragraph 30).

It is also important to recall that it follows from the objective of ensuring an equivalent level of protection in all Member States, pursued by that directive, that Article 7 thereof sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful (see judgment of 24 November 2011, ASNEF and FECEMD, C‑468/10 and C‑469/10, EU:C:2011:777, paragraph 30).