Should a public library use letter c) instead of letter f) as the legal basis for processing?

ANSWER

The Libraries Act imposes on libraries an obligation to protect library materials as one of their basic tasks. This obligation cannot be fulfilled without knowledge of the persons to whom materials are made available. From this task therefore arises the right to process data to the extent sufficient to protect library collections, and in practice to ensure fulfilment of the entitlement arising from Article 14(2)(5) of the Libraries Act. The legal ground legitimising processing of readers' data under the GDPR will therefore be Article 6(1)(c) GDPR.