Public task / official authority basis
Basis 6(1)(e) covers processing necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller. The GDPR removed the Directive's third category (official authority vested in a third party recipient), so this basis is narrower than before. EU or member-state law determines what counts as a public-interest task. A key feature: data subjects have the right to object, and the controller must show compelling legitimate grounds to continue.
The GDPR narrowed this basis by removing the Directive category of official authority vested in a third party to whom data are disclosed. EU or member-state law determines which tasks are public-interest tasks. See also the extra detail in 7.2.8.
Where a controller relies on 6(1)(e), the data subject has the right to object. On objection, the controller must demonstrate compelling legitimate grounds that override the interests, rights and freedoms of the subject, or that processing is for the establishment, exercise or defence of legal claims.