Privacy Ref Blog

Can Consent Fall Short in GDPR?

Over the past several months, I have been taking a deeper dive into GDPR. I have found Article 6 on the legal basis for processing data particularly interesting. There is some discussion to be had for each company and how they will process data in a particular case, but I often hear that consent will be used. I have even heard arguments for consent as a catch-all for processing. This ignores the pitfalls that could come with the use of that certain legal basis.

Where consent falls short

The first thing anyone should remember is that consent in the GDPR has a number of requirements. It must be clear, unambiguous, freely given, and specific in order to meet the GDPR’s strict requirements. Even after all of this is met though, the data subject can rescind their consent and request you cease processing. The means consent as a legal basis can be a catch all, and used for almost any purpose when it comes to processing data, but should be treated as a secondary option whenever possible.  There may be a stronger legal basis for you.

Utilizing a different basis

Besides consent, there are a number of legal basis that you can utilize.  Some are more situational, such as handling a life or death situation, or processing for the interest of the general public. The two you may want to investigate further are processing to execute a contract and legitimate business interest.

Executing a contract is very straight forward. If you entered into a contract with a customer, or are preparing to, you have to hold up your end of the bargain. As long as you stay within the scope of that contract, you are safe to process the information that is required to prepare for and fulfill that contract.

Totally legit

Processing for a legitimate business interest (LBI) has some level of complexity, but luckily there is some advice in GDPR itself in order to comply. A great example of a LBI is to prevent fraud or for security reasons. Processing data to ensure someone didn’t steal someone else’s information not only helps your business maintain trust and compliance, but also helps the actual data subject of that information. This balance, where both you and the data subject are benefitting in some way, is important for establishing and proving a legitimate business interest.

Data subjects’ rights

A data subject can object, request restriction, or erasure of data pertaining to them. Within the articles describing these rights is also a description of the data controller providing the legal basis of processing. In some cases, you can continue to process the data if the LBI is sufficient, and in others you have to stop right away (think direct marketing).

Remember, a data subject’s rights and the legal basis for your processing must appear in your privacy notice.

Privacy Ref provides consulting and assessment services to build and improve organizational privacy programs. For more information call Privacy Ref at (888) 470-1528 or email us at info@privacyref.com

Posted on August 14, 2017 by Ben Siegel
Tags: , , ,

« »

No Responses

Comments are closed.


« »

Subscribe to our mailing list

Please fill out the form below.

Required

Want to find out more?

Simply go to the contact page, fill out the form, and someone from Privacy Ref will be in touch with you. You can also send an email to info@privacyref.com or call (888) 470-1528.

News

May 10, 2017

Predictive Breach Cost Model
Download our predictive breach cost modelhere.

Latest Blog Posts

October 30, 2017

PSR 2017 in Review
After a long trip from the northeast to San Diego, I finally made it to another exciting Privacy, Security, and Risk Conference from the IAPP. With GDPR on the horizon, the air was thick with discussion of this regulation in effect in May of next year. Even more so, a lot of questions received at the Privacy Ref booth were focused on this law, or preparing a privacy program through assessments data mapping. Overall, a great show with a few major themes. Continue reading this post...

The key to effective privacy training
I spend a lot of time facilitating privacy training. Whether it is directly for our clients or on behalf of the IAPP or their training partners, there are common elements to a successful educational event. Continue reading this post...

Other Recent Posts

PRIVACY REF