Lawful Basis – It’s Not All About Consent

Advantages

1. Gives the Data Subject choices and control over the processing of their data

Disadvantages

1. Consent, in the form of a positive opt in, will need to be documented and retained so that you can demonstrate it was obtained.

2. Consent must be ‘freely given, specific, informed and unambiguous’

3. Specific:

   Consent cannot be blanket consent, different consents for different purposes must be obtained.

4. Unambiguous:

   There must always be a clear distinction between the information needed for the informed consent and information about other matters.

5. Freely Given:

   Consent should be voluntary and involve a real choice. Invalid consent could lead to regulatory fines.

6. Data Subjects have stronger rights to have their data deleted where consent is the only legal basis for processing their personal data. Consent can be withdrawn at any time and the GDPR requires that the data subject is informed of this and that it is easy to withdraw consent.

7. European data protection authorities have made it clear “that if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.” Strictly interpreted, this means the controller is not allowed to switch from the legal basis consent to legitimate interest once the data subject withdraws his consent. This applies even if a valid legitimate interest existed initially. Therefore, consent should always be chosen as a last option for processing personal data.

Example of when consent may be an appropriate lawful basis:

A school asks students for consent to use their photographs in a printed student magazine. Consent in these situations would be a genuine choice as long as students will not be denied education or services and could refuse the use of these photographs without any detriment.

Advantages

1. As long as processing the personal data is necessary for the purposes of the contract, a contract with the data subject gives a legal basis for processing personal data without the requirement for recording separate consent. This is appropriate for processing employee data as an employment contract is required.

2. A contract does not necessarily have to be in writing

Disadvantages

1. If the contract is with a minor, consider whether they have the necessary competence to enter into a contract. If you there are doubts about their competence, consider an alternative basis such as legitimate interests.

   Note that ‘child’ in the Irish Data Protection Act means under 18.

2. If the processing is not necessary for the contract, another lawful basis such as legitimate interests or consent would need to be considered.

Example of when contract may be an appropriate lawful basis:

In the employment context when a person applies for a vacant position in your organisation, they can be deemed to have requested you to take steps before entering into a contract. When they become an employee, you will have a contractual basis to process their personal data in the course of their employment.

Advantages

1. Processing personal data to comply with a legal or statutory obligation set out in Irish or EU law is a strong lawful basis under GDPR

Disadvantages

1. The legal obligation must be on you, the data controller and you must be able to identify the specific legislation you are required to comply with. This does not apply to contractual obligations.

Example of when legal obligation may be an appropriate lawful basis:

A financial institution relies on the legal obligation imposed by the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 to process personal data in order submit a Suspicious Activity Report to the regulatory authorities when it knows or suspects that a person is engaged in, or attempting, money laundering.

Advantages

1. Processing personal data without consent is permitted in instances where it is in the vital interest of the data subject such as where there has been an accident or emergency and the data subject cannot give consent but requires treatment or transfer to a hospital to preserve life.

1. You cannot rely on vital interests for health data or other special category data if the individual is capable of giving consent, even if they refuse their consent.

Example of when vital interests may be an appropriate lawful basis:

An individual is admitted to the A & E department of a hospital with life-threatening injuries following a serious road accident. The disclosure to the hospital of the individual’s medical history is necessary in order to protect his/her vital interests.

Advantages

1. You can rely on this lawful basis if you need to process personal data:

   ‘in the exercise of official authority’. This covers public functions and powers that are set out in law;

   or to perform a specific task in the public interest that is set out in law.

2. Any organisation who is exercising official authority or carrying out a specific task in the public interest. The focus is on the nature of the function, not the nature of the organisation.

Disadvantages

1. This legal basis can only be used when an organisation is exercising official authority or carrying out a specific task in the public interest.

2. For accountability purposes, you should be able to specify the relevant task, function or power, and identify its basis in common law or statute. You should also ensure that you can demonstrate there is no other reasonable and less intrusive means to achieve your purpose.

Advantages

1. Legitimate interest is the most flexible lawful basis for processing. It is appropriate where the personal data is being processed in ways which data subjects would reasonably expect and there is a compelling reason for processing. Legitimate interests can include commercial interests, individual interests or broader societal benefits.           

2. Avoids having to collect and retain consent and bombarding people with unnecessary consent requests, can help avoid ‘consent fatigue’.

3. If a controller wishes to process the personal data for a new purpose, they may be able to continue processing under legitimate interests as long as the new purpose is compatible with the original purpose.   

4. A controller may be able to lawfully disclose data on the basis of legitimate interests. These might be the controller’s own interests, the interests of the third party receiving the data, or a combination of the two.      

5. Data Subjects can object to processing on the grounds of legitimate interests, although that is not an absolute right and the controller can continue to process where they can demonstrate a compelling reason, or the processing is in relation to a legal claim.

Disadvantages

1. Although legitimate interest is a flexible concept, it does not apply to everything and should not be used as a default basis for processing.

2. By choosing legitimate interests there is an extra responsibility for considering and protecting people’s rights and interests. This includes carrying out a legitimate interest balance test or assessment to ensure that the data subject’s rights and interests are not outweighed by the data controller’s rights. There is scope for disagreement over the balance test and you need to be able to clearly justify your decision.

   Article 6(1)(f) specifically highlights children’s personal data as requiring particular protection.

Example of when legitimate interests may be an appropriate lawful basis:

An insurance company wants to process personal data to spot fraudulent claims on the basis of legitimate interests. It is in the company’s legitimate business interests to ensure that its customers do not defraud it out of money. However at the same time the company’s other customers and the public in general also have a legitimate interest in ensuring that fraud is prevented and detected.