Thanks Tapani,

I will extract from your longer message.
I deliberately kept my brief and less technical.
I think we are in agreement here and I support your position.

On 2/7/2018 1:07 AM, Tapani Tarvainen wrote:

The key distinction, as I understand it, is that "lawful" would be
defined by the negative, everything that some law does not prohibit,

where as "legal basis" is defined by the positive, only things whose
justification can be explicitly derived from law.

<......>

So I would prefer "legal basis" specifically in this sense: that any processing
would have to be explicitly based on one of the criteria, or bases, as listed
in GDPR Article 6, or similar explicit justification in other data protection legislation.