gdpr
Under GDPR can I avoid divulging a customer&#39;s data to the government?
<p>Scenario:</p>

<ul>
<li>A business has a legal requirement to obtain a license from a government agency relating to its business activities.</li>
<li>The business activities have already being undertaken and there is no way to avoid the need for the license (e.g. by ceasing the activities).</li>
<li>The license application form asks for customers' personal data (names plus basic details relating to their contracts e.g. dates).</li>
<li>The business feels uncomfortable divulging such data to the government, and is pretty sure their customers would be unhappy if they knew about it.</li>
<li>The business, the customers, and the government, are all located in the EU.</li>
</ul>

<p>What is the position in relation to GDPR? Can the business refuse to complete the relevant sections of the license application?</p>

<p>My starting point is <a href="https://gdpr-info.eu/" rel="nofollow noreferrer">GDPR</a> Articles 4(2) and 6(1)(c) (emphasis added):</p>

<blockquote>
  <p>4(2) <strong>‘processing’ means</strong> any operation or set of operations which is
  performed on personal data or on sets of personal data, whether or not
  by automated means, such as collection, recording, organisation,
  structuring, storage, adaptation or alteration, retrieval,
  consultation, use, <strong>disclosure by transmission, dissemination or
  otherwise making available</strong>, alignment or combination, restriction,
  erasure or destruction;</p>
  
  <p>6(1) <strong>Processing shall be lawful</strong> only <strong>if</strong> and to the extent that
  at least one of the following applies: (c) <strong>processing is necessary
  for compliance with a legal obligation</strong> to which the controller is
  subject;</p>
</blockquote>

<p>This would seem to indicate to me that the business does indeed have to divulge the information. Is this correct?</p>

<p>Your analysis so far seems correct. You <em>must</em> comply with all applicable laws. The GDPR's Art 6(1)(c) legal basis clarifies that having to provide personal data is no excuse: that legal obligation is all the legal basis you need for sharing the personal data in accordance with your obligations.</p>

<p>However, that legal basis doesn't generally excuse you from your other data controller obligations. For example, you should still inform the data subjects about the processing as per Art 13(3).</p>
