how does it tie back, what's the reasons, is it because of something else, is there a secondary factor to it, if that's the case it might be something to do with employment, so it'd be employment contract, it might be that the decision you're making is a matter of life and death, in which case you know we've got vital interest in there, there's another lawful basis, so you can pretty much make one of them stick to whatever you're trying to do, I've never really come across an organisation that's proposed to do something that we can't make fit somewhere, because you've always got that legitimate interest, haven't you, Amy, where we can be a little bit flexible with that, which we'll talk about, which we'll talk about.

I mean, I think the important thing is, is to have one of them, make one of them, make your process and fit into one of them, because, I mean, if you look at Serco Leisure, which the ICO took action against, They brought in this great new system, great new software to help them get employees logged in easily, that facial recognition and fingerprint scanning, and they had no lawful basis for doing so because again, They didn't think of it during the beginning of the project and the ISO was concerned that they weren't demonstrating why this processing was necessary and if there was less intrusive alternatives and they hadn't established an appropriate lawful basis for processing the special category data as well in that case.

So it's the same data set, but for two

completely different legal reasons.

And then another one's not documenting your decisions.

So whoever has decided that lawful basis, wherever that decision's come from, not having it written down anywhere.

That person moves on.

Nobody knows why it was done.