1. Definition of Official Authority

• Under GDPR Article 6(1)(e), processing is lawful if it is:

“necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.”

• “Official authority” generally refers to powers vested in public bodies by law (e.g., police, regulators, tax authorities, licensing bodies).

2. Role of Medical Practitioners

• Private medical practitioners (e.g., doctors in private practice, hospitals) → not official authorities. Their lawful bases for processing are usually:
• Article 6(1)(b) → performance of a contract (providing medical care).
• Article 6(1)(c) → compliance with legal obligations (medical record-keeping laws).
• Article 6(1)(d) → vital interests (life-saving situations).
• Article 9(2)(h) → processing of special category data (health data) for healthcare purposes.
• Public healthcare providers (state hospitals, national health services) → may process under public interest / official authority, because their mandate comes from statutory law.
• Example: The UK's NHS or a South African public hospital processing patient data under the National Health Act.

3. Distinction in Practice

• Official Authority → A statutory mandate to process data for the public good, backed by law.
• Healthcare Practitioners →
• In private sector: Not official authority, but still lawful processors using other bases.
• In public sector: May rely on “public interest” or “official authority” because their mandate is grounded in national law.

4. Practical Examples

• Private Doctor (South Africa / EU):
• A GP in private practice is not exercising official authority.
• Lawful basis: Providing healthcare services (contract), vital interests, or legal obligation.
• Public Hospital (EU Member State):
• Collects patient data under a national health law.
• Lawful basis: Task in the public interest / exercise of official authority (Art. 6(1)(e)) + health data exception (Art. 9(2)(h)).
• Pandemic Response (Both Public & Private):
• If mandated by law to report certain cases (e.g., COVID-19 test results to health ministry), even private practitioners may be acting under official authority delegated by law.

✅ Conclusion

• Private medical practitioners = Not official authority. They rely on contract, vital interests, legal obligations, or healthcare-specific exceptions.
• Public healthcare providers = Yes, may qualify as official authority, because their mandate is vested in law.
• The distinction lies in whether their role is created or empowered by law (official authority) or by contractual/professional duty.