Faq – Lawfulness of processing

Lawfulness of processing

How should consent be expressed?

Consent should be expressed by an affirmative unambiguous action (so called «opt-in») establishing a freely given, informed and specific indication of the data subject’s agreement to the processing of personal data. It can be a written statement, including electronic means, or an oral statement. This could include ticking a box when visiting a website. Silence or inactivity should not be considered valid consent. Pre-ticked boxes do not constitute a valid consent (since it is not freely expressed). Consent should cover all processing activities carried out for the same purpose or purposes. When data processing has multiple purposes, consent should be expressed separately for each purpose.

Is consent required in order to perform a service or an order?

The legal basis is the performance of a contract to which the data subject is party and, therefore, consent is not required.

When may the legitimate interest provide a legal basis for processing?

The legitimate interest may constitute a legal basis for processing provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into account the reasonable expectations of data subjects based on their relationship with the controller. A legitimate interest may provide a legal basis where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a customer or an employee of the controller. However, the existence of a legitimate interest requires a careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of personal data that processing for that purpose may take place. So, a legitimate interest may provide a legal basis for processing carried out to prevent fraud or to defend a right in court. It may be regarded as a valid legal basis even for direct marketing purposes (in the event of data relating to customers, or donors for not-for-profit organisations).

To learn more, click here or contact me.