Reply to post: failing to have a lawful reason for collecting it

failing to have a lawful reason for collecting it

The article says one of the reasons for the fine is "failing to have a lawful reason for collecting it". ICO's own article actually says "failing to have a lawful reason for collecting people’s information".

It is not 100% clear whether this is a reference to: (a) failing to have any valid/defined legitimate purpose(s) (GDPR Article 5(b)), or (b) failing to have any valid defined lawful bases/conditions (GDPR Articles 6(1) and 9(2)).

I assume the ICO is referring to GDPR Article 5(b) "legitimate purpose(s)".

You'd expect the ICO to use the correct legal terminology in their press release so as to be clear as to which of these they were referring to. Then again it is the ICO...