Mr. Denis Kelleher:

It is straightforward. Article 6(1) of the GDPR provides that "processing shall be lawful only if and to the extent that .... [it] is necessary for compliance with a legal obligation to which the controller is subject". The basis for such processing, and for processing that "is necessary for the performance of a task carried out in the public interest"-----