Legal obligation
The “legal obligation” basis for processing personal data (see Art. 6(c) GDPR) has to be interpreted as encompassing the obligation to comply with a legislated act, other statute, collective agreement or decision issued pursuant to an act or other statute.
Children’s consent
In Sweden, the age at which a child can provide valid consent is reduced to 13 years old (DPA Chapter 2(4)). If the child is under 13, the processing is lawful only if and to the extent the legal parent or guardian of the child has consented (DPA Chapter 2(4)).
