Privacy Ref Blog

Can Consent Fall Short in GDPR?

Over the past several months, I have been taking a deeper dive into GDPR. I have found Article 6 on the legal basis for processing data particularly interesting. There is some discussion to be had for each company and how they will process data in a particular case, but I often hear that consent will be used. I have even heard arguments for consent as a catch-all for processing. This ignores the pitfalls that could come with the use of that certain legal basis.

Where consent falls short

The first thing anyone should remember is that consent in the GDPR has a number of requirements. It must be clear, unambiguous, freely given, and specific in order to meet the GDPR’s strict requirements. Even after all of this is met though, the data subject can rescind their consent and request you cease processing. The means consent as a legal basis can be a catch all, and used for almost any purpose when it comes to processing data, but should be treated as a secondary option whenever possible.  There may be a stronger legal basis for you.

Utilizing a different basis

Besides consent, there are a number of legal basis that you can utilize.  Some are more situational, such as handling a life or death situation, or processing for the interest of the general public. The two you may want to investigate further are processing to execute a contract and legitimate business interest.

Executing a contract is very straight forward. If you entered into a contract with a customer, or are preparing to, you have to hold up your end of the bargain. As long as you stay within the scope of that contract, you are safe to process the information that is required to prepare for and fulfill that contract.

Totally legit

Processing for a legitimate business interest (LBI) has some level of complexity, but luckily there is some advice in GDPR itself in order to comply. A great example of a LBI is to prevent fraud or for security reasons. Processing data to ensure someone didn’t steal someone else’s information not only helps your business maintain trust and compliance, but also helps the actual data subject of that information. This balance, where both you and the data subject are benefitting in some way, is important for establishing and proving a legitimate business interest.

Data subjects’ rights

A data subject can object, request restriction, or erasure of data pertaining to them. Within the articles describing these rights is also a description of the data controller providing the legal basis of processing. In some cases, you can continue to process the data if the LBI is sufficient, and in others you have to stop right away (think direct marketing).

Remember, a data subject’s rights and the legal basis for your processing must appear in your privacy notice.

Privacy Ref provides consulting and assessment services to build and improve organizational privacy programs. For more information call Privacy Ref at (888) 470-1528 or email us at info@privacyref.com

Posted on August 14, 2017 by Ben Siegel
Tags: , , ,

« »

No Responses

Comments are closed.


« »

Subscribe to our mailing list

Please fill out the form below.

Required

Want to find out more?

Simply go to the contact page, fill out the form, and someone from Privacy Ref will be in touch with you. You can also send an email to info@privacyref.com or call (888) 470-1528.

News

May 10, 2017

Predictive Breach Cost Model
Download our predictive breach cost modelhere.

Latest Blog Posts

September 18, 2017

Burying your head in the sand won’t make Data Protection requirements go away
Recently, I had dinner with  a colleague that I had not seen in several years. Their company, a multinational with global operations, had undergone several changes in that time. When the dust settled, this friend had been tapped as "privacy manager". Along with corporate counsel (part time for privacy), they decided that, even under GDPR, they did not need a Privacy / Data Protection Officer . Huh? Continue reading this post...

August 14, 2017

Privacy Ref and CyberDefenses Bring Privacy and Security Together
There is a saying that you can have security without privacy, but you cannot have privacy without security. While privacy and security are both concerned with the protection of information held by an organization, security provides the means to meet the business requirements identified to meet privacy demands from regulators, customers, employees, and other stakeholders. Privacy Ref works with our clients to improve their business and operational practices for protecting personal information. Increasingly our clients’ have been looking for services to supplement their security practices, tools, and expertise. CyberDefenses fills this role. Continue reading this post...

Other Recent Posts

PRIVACY REF