Over the past several months, I have been taking a deeper dive into GDPR. I have found Article 6 on the legal basis for processing data particularly interesting. There is some discussion to be had for each company and how they will process data in a particular case, but I often hear that consent will be used. I have even heard arguments for consent as a catch-all for processing. This ignores the pitfalls that could come with the use of that certain legal basis.
Where consent falls short
The first thing anyone should remember is that consent in the GDPR has a number of requirements. It must be clear, unambiguous, freely given, and specific in order to meet the GDPR’s strict requirements. Even after all of this is met though, the data subject can rescind their consent and request you cease processing. The means consent as a legal basis can be a catch all, and used for almost any purpose when it comes to processing data, but should be treated as a secondary option whenever possible. There may be a stronger legal basis for you.
Utilizing a different basis
Besides consent, there are a number of legal basis that you can utilize. Some are more situational, such as handling a life or death situation, or processing for the interest of the general public. The two you may want to investigate further are processing to execute a contract and legitimate business interest.
Executing a contract is very straight forward. If you entered into a contract with a customer, or are preparing to, you have to hold up your end of the bargain. As long as you stay within the scope of that contract, you are safe to process the information that is required to prepare for and fulfill that contract.
Totally legit
Processing for a legitimate business interest (LBI) has some level of complexity, but luckily there is some advice in GDPR itself in order to comply. A great example of a LBI is to prevent fraud or for security reasons. Processing data to ensure someone didn’t steal someone else’s information not only helps your business maintain trust and compliance, but also helps the actual data subject of that information. This balance, where both you and the data subject are benefitting in some way, is important for establishing and proving a legitimate business interest.
Data subjects’ rights
A data subject can object, request restriction, or erasure of data pertaining to them. Within the articles describing these rights is also a description of the data controller providing the legal basis of processing. In some cases, you can continue to process the data if the LBI is sufficient, and in others you have to stop right away (think direct marketing).
Remember, a data subject’s rights and the legal basis for your processing must appear in your privacy notice.