Privacy Ref Blog

Can Consent Fall Short in GDPR?

Over the past several months, I have been taking a deeper dive into GDPR. I have found Article 6 on the legal basis for processing data particularly interesting. There is some discussion to be had for each company and how they will process data in a particular case, but I often hear that consent will be used. I have even heard arguments for consent as a catch-all for processing. This ignores the pitfalls that could come with the use of that certain legal basis.

Where consent falls short

The first thing anyone should remember is that consent in the GDPR has a number of requirements. It must be clear, unambiguous, freely given, and specific in order to meet the GDPR’s strict requirements. Even after all of this is met though, the data subject can rescind their consent and request you cease processing. The means consent as a legal basis can be a catch all, and used for almost any purpose when it comes to processing data, but should be treated as a secondary option whenever possible.  There may be a stronger legal basis for you.

Utilizing a different basis

Besides consent, there are a number of legal basis that you can utilize.  Some are more situational, such as handling a life or death situation, or processing for the interest of the general public. The two you may want to investigate further are processing to execute a contract and legitimate business interest.

Executing a contract is very straight forward. If you entered into a contract with a customer, or are preparing to, you have to hold up your end of the bargain. As long as you stay within the scope of that contract, you are safe to process the information that is required to prepare for and fulfill that contract.

Totally legit

Processing for a legitimate business interest (LBI) has some level of complexity, but luckily there is some advice in GDPR itself in order to comply. A great example of a LBI is to prevent fraud or for security reasons. Processing data to ensure someone didn’t steal someone else’s information not only helps your business maintain trust and compliance, but also helps the actual data subject of that information. This balance, where both you and the data subject are benefitting in some way, is important for establishing and proving a legitimate business interest.

Data subjects’ rights

A data subject can object, request restriction, or erasure of data pertaining to them. Within the articles describing these rights is also a description of the data controller providing the legal basis of processing. In some cases, you can continue to process the data if the LBI is sufficient, and in others you have to stop right away (think direct marketing).

Remember, a data subject’s rights and the legal basis for your processing must appear in your privacy notice.

Privacy Ref provides consulting and assessment services to build and improve organizational privacy programs. For more information call Privacy Ref at (888) 470-1528 or email us at

Posted on August 14, 2017 by Ben Siegel
Tags: , , ,

« »

No Responses

Comments are closed.

« »

Subscribe to our mailing list

Please fill out the form below.


Want to find out more?

Simply go to the contact page, fill out the form, and someone from Privacy Ref will be in touch with you. You can also send an email to or call (888) 470-1528.


May 10, 2017

Predictive Breach Cost Model
Download our predictive breach cost modelhere.

Latest Blog Posts

March 17, 2018

Looking forward to the IAAP Global Privacy Summit
It's that time of year again; time for the IAPP's Global Privacy Summit. Yes, I pack up this weekend to head to Washington, DC for training, seminars and, of course, networking. Continue reading this post...

March 8, 2018

Do It Your Self Rights Requests
On our last webinar (as of this writing) I discussed how a company can handle data subject’s rights requests under GDPR. Many of these requests are going to require attention, such as those ‘right to be forgotten’ requests. Others may seem daunting but can be handled easily and may not require any direct participation from your end. Continue reading this post...

Other Recent Posts