Privacy Ref Blog

Can Consent Fall Short in GDPR?

Over the past several months, I have been taking a deeper dive into GDPR. I have found Article 6 on the legal basis for processing data particularly interesting. There is some discussion to be had for each company and how they will process data in a particular case, but I often hear that consent will be used. I have even heard arguments for consent as a catch-all for processing. This ignores the pitfalls that could come with the use of that certain legal basis.

Where consent falls short

The first thing anyone should remember is that consent in the GDPR has a number of requirements. It must be clear, unambiguous, freely given, and specific in order to meet the GDPR’s strict requirements. Even after all of this is met though, the data subject can rescind their consent and request you cease processing. The means consent as a legal basis can be a catch all, and used for almost any purpose when it comes to processing data, but should be treated as a secondary option whenever possible.  There may be a stronger legal basis for you.

Utilizing a different basis

Besides consent, there are a number of legal basis that you can utilize.  Some are more situational, such as handling a life or death situation, or processing for the interest of the general public. The two you may want to investigate further are processing to execute a contract and legitimate business interest.

Executing a contract is very straight forward. If you entered into a contract with a customer, or are preparing to, you have to hold up your end of the bargain. As long as you stay within the scope of that contract, you are safe to process the information that is required to prepare for and fulfill that contract.

Totally legit

Processing for a legitimate business interest (LBI) has some level of complexity, but luckily there is some advice in GDPR itself in order to comply. A great example of a LBI is to prevent fraud or for security reasons. Processing data to ensure someone didn’t steal someone else’s information not only helps your business maintain trust and compliance, but also helps the actual data subject of that information. This balance, where both you and the data subject are benefitting in some way, is important for establishing and proving a legitimate business interest.

Data subjects’ rights

A data subject can object, request restriction, or erasure of data pertaining to them. Within the articles describing these rights is also a description of the data controller providing the legal basis of processing. In some cases, you can continue to process the data if the LBI is sufficient, and in others you have to stop right away (think direct marketing).

Remember, a data subject’s rights and the legal basis for your processing must appear in your privacy notice.

Privacy Ref provides consulting and assessment services to build and improve organizational privacy programs. For more information call Privacy Ref at (888) 470-1528 or email us at info@privacyref.com

Posted on August 14, 2017 by Ben Siegel
Tags: , , ,

« »

No Responses

Comments are closed.


« »

Subscribe to our mailing list

Please fill out the form below.

Required

Want to find out more?

Simply go to the contact page, fill out the form, and someone from Privacy Ref will be in touch with you. You can also send an email to info@privacyref.com or call (888) 470-1528.

News

April 16, 2018

IAPP Training Classes
Privacy Ref is proud to announce that we are an official training partner of the IAPP. You now have the opportunity to learn from one of our knowledgeable privacy professionals using the most respected training content in the industry. The robust interactive training offered, aids in the understanding of critical privacy concepts. The contents of the courses are integral to obtaining your privacy certifications and to educate your new team. Learn more here.

Latest Blog Posts

September 21, 2018

Is Your Biometric Clock Ticking?
I recently read an article published on the Society for Human Resource Management’s website on the prevalence of biometrics in the employment context. Specifically, the author referenced a Spiceworks’ survey of IT professionals from February 2018 that provided, in my mind, surprising results. Continue reading this post...

Other Recent Posts

PRIVACY REF