56That list of cases in which the processing of personal data may be regarded as lawful is exhaustive and restrictive, so that, in order that it can be regarded as lawful, processing must fall within one of the cases provided for in the first subparagraph of Article 6(1) of the GDPR (see, to that effect, judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 99 and the case-law cited, and of 8 December 2022, Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of the processing of personal data – Criminal investigation), C‑180/21, EU:C:2022:967, paragraph 83).
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.