The answer from your DPA mentions article 6, which states: "Processing shall be lawful only if and to the extent that at least one of the following applies: [.

The answer from your DPA mentions article 6, which states: "Processing shall be lawful only if and to the extent that at least one of the following applies: [...] (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller" While this might apply to everyone, only governmental organizations will be able to convincingly base the lawfulness of their processing on that. (Guessing - IANAL)