A charity operates a confidential helpline for people experiencing domestic abuse. A caller who is being assaulted phones in clear and immediate danger, cannot give consent, and the charity needs to share the caller's location and disclosed health condition with emergency services to prevent serious harm. The charity wants to invoke the vital interests condition in Article 9(2)(c). For the condition to apply to this special category data, which requirement must be met?
- AA medical professional bound by a duty of secrecy must authorise the disclosure before the location and health data can be shared with emergency services
- BThe processing must first be authorised by a Union or Member State law specifically permitting disclosure to emergency services
- CThe data subject must be physically or legally incapable of giving consent at the time the processing is necessary to protect their vital interests or those of another person Correct
- DThe charity must obtain the caller's explicit consent as soon as the immediate danger has passed, otherwise the original disclosure becomes unlawful retrospectively
Why A is wrong: The secrecy-bound professional requirement belongs to Article 9(2)(h) for healthcare processing; it is not a precondition of the vital interests route, so importing it here misstates the test.
Why B is wrong: A specific statutory authorisation is required for conditions such as 9(2)(b), (g), (h), (i) and (j), but Article 9(2)(c) does not need its own enabling law; it operates on incapacity to consent, so this requirement is misplaced.
Why C is correct: Article 9(2)(c) is available for protecting vital interests only where the data subject is physically or legally incapable of giving consent; a caller in immediate danger and unable to consent satisfies this gating requirement.
Why D is wrong: Vital interests processing does not become retroactively unlawful for want of later consent; the condition stands on its own at the time of processing, so this confuses the consent and vital interests routes.