Consent not suffice as grounds?

When does consent not suffice as grounds for the processing of personal data?

Introduction

Many companies and organisations are unsure whether they need permission to process personal data about their customers or employees ('data subjects'). The uncertainty cause those who process personal data to quickly be tempted to always ask for consent. In itself, this is an understandable reflex: those who have obtained permission to process certain personal data imagine themselves legally safe, because many companies and organisations have the misconception that permission is always sufficient to comply with legal requirements concerning the processing of privacy-sensitive data.

There are two common situations where the question of whether to ask for consent often arises. The data controller may ask for consent as a ground for processing someone's personal data under the General Data Protection Regulation (GDPR). The provider of a digital service that wants to place cookies on someone's peripherals asks for permission under the so-called "Cookie Act", which is laid down in the Telecommunications Act (Tw).

This article addresses the question in which cases consent does not suffice as a basis for processing personal data under the GDPR.

What is the purpose of asking permission to process personal data?

The General Data Protection Regulation (GDPR) imposes several principles on the processing of personal data. One of these principles - laid down in Article 5(1)(a) of the GDPR - is that the processing of personal data must be proper, lawful and transparent. The processing of personal data must therefore be lawful. The question arises what makes the processing of personal data lawful. The answer to that question is that the processing of personal data is only lawful if there is a basis for that processing. The grounds are listed in article 6 GDPR.

The rules for special categories of personal data, such as data about race, health and sexual orientation, are even stricter. The grounds for processing in article 6 of the GDPR do not apply to the processing of special personal data, instead exceptions to the ban on processing these categories of data apply. In principle it is forbidden to process special personal data, unless one of the grounds for exception in article 9 of the GDPR can be invoked. It is true that the explicit consent of the person concerned is also one of the grounds for exception to the ban on processing special personal data.

In short, the processing of personal data must be lawful, and the processing of personal data is lawful if it can be based on one of the principles in the GDPR. The data subject's consent is one of the grounds, so consent can serve as a means to achieve lawful processing of personal data. However, asking permission to process personal data will not suffice in all cases.

What requirements does the GDPR set for consent?

It is a risky mistake to assume that asking a data subject for consent is always sufficient to satisfy the principle of lawfulness. The GDPR has a strict definition of consent. Consent is defined as a free, specific, informed and unambiguous expression of will. Herein lies a potential pitfall for those intending to request consent. Depending on the situation in which the expression of will was made, discussion may arise about whether the person concerned was actually able to give consent in a way that meets the criteria of free, specific, informed and unambiguous expression of will.

Situations in which a data subject is usually unable to give free, specific, informed and unambiguous consent include situations in which there is an unequal power relationship between the data controller and the data subject. A concrete example that often occurs in practice is that the data subject is an employee who is asked for permission to process his or her personal data by their employer, on whom the employee is largely dependent for their livelihood.

It will not be the case that in every employer-employee relationship the employee actually experiences so much pressure that he or she would not dare refuse to give permission. However, from the perspective of the employer as the controller under the GDPR, it is much wiser and more practical to designate a more obvious ground for processing, rather than consent, a ground that is uncertain for an employer. Alternative grounds under the GDPR include 'performance of a contract with the employee', or 'the legitimate interests of the employer'.

If the basis is the execution of the employment contract with the employee, then of course the employment contract must actually contain provisions that pertain to the necessary processing of personal data. If there is no such basis in the employment contract with the employee, then the legitimate interest of the employer in processing the personal data will be the most obvious legal ground for processing personal data.

What grounds for processing exist apart from the data subject's consent?

In addition to data subject consent, the General Data Protection Regulation (GDPR) contains five other grounds for processing personal data.

Necessary for the performance of a contract with the data subject

The data subject will probably already have had the opportunity to consider the processing of his personal data when entering into an agreement with the controller for the performance of which it will be necessary to process the data subject's personal data. The data subject will have entered into the agreement in his own interest; moreover, an agreement entered into under duress will not hold up legally.

Please note! It should concern the performance of a contract with the data subject itself, not a contract concluded with another party for the performance of which the data subject’s personal data may be processed.

Necessary for compliance with a legal obligation of the responsible party

Based on other laws or regulations than the GDPR, it may happen that a data controller does not have a desire or interest to process certain personal data, but is required by law to do so. An example is legislation concerning the keeping of certain records or archives.

Vital interests of the data subject

Vital interests are so-called "matters of life and death". If a person is in distress, it is not in the interest of the data subject or those trying to rescue them if they have to ask themselves whether they might need consent or some other basis for processing their personal data during a rescue attempt.

Necessary to perform a public task

Public authorities and organizations that have been legally entrusted by the government with a task of public authority derive the lawfulness of the processing of personal data from the underlying legislation. The GDPR is not intended to stand in the way of the exercise of public authority, as long as that public authority task is enshrined in legislation under democratic control.

Legitimate interests of the controller

The legitimate interests of the controller are a broad category that may serve, as it were, as a safety net when none of the other grounds for processing are obvious in a given situation, but the processing of personal data cannot be dispensed with either. A successful reliance on the basis of legitimate interests will require that the justification of what exactly the controller's interest is in processing the personal data can be explained and clarified. In addition, the data controller will have to be able to demonstrate that this interest actually prevails over the data subject's interest in the protection of their privacy rights.

The data subject has the right to object to the use of this legal ground. The data subject can argue that the data controller has no legitimate interest in processing his or her personal data, or that the interests of the data subject outweigh the controllers interests. The national Data Protection Authority or a court may rule on the weighing of interests.

Where should it be indicated which of the processing grounds have been chosen?

Under the GDPR, the controller is obliged to state the grounds on which the processing of personal data is based. If a third party is engaged for the processing, this statement must be made, among other things, in a data processing agreement between a data controller and the processor it engages, pursuant to Article 28 GDPR. There is also an active duty to inform towards the data subject pursuant to Article 13 GDPR et seq., if the personal data are obtained directly from the data subject. The privacy statement is a frequently used tool in which the grounds for processing can be stated.

The Authority for the Protection of Personal Data advises to substantiate the choice for a certain legal ground and to always state this substantiation. After all, the person responsible for processing has a duty of accountability, on the basis of which he must be able to demonstrate the lawfulness of the processing at all times.

Conclusion

The GDPR has several principles for the processing of personal data. One of these principles is that the processing of personal data can only be allowed if it is done in a lawful, proper and transparent manner. The processing of personal data is only lawful if a legal basis for that processing can be provided. Consent of the person whose personal data are processed can provide the legal basis for processing personal data, but obtaining permission does not always qualify as valid.

The GDPR uses a strict definition of consent. Consent in the sense of the GDPR is a free, specific, informed and unambiguous expression of will. Depending on the specific situation, the consent of the data subject may be less obvious than another legal ground for processing personal data. In situations where the degree to which the data subject was able to give free, specific, informed and unambiguous consent within the meaning of the GDPR could be called into question, it would be wiser to use a different basis than consent for the lawful processing of personal data.

Questions

Do you know which categories of personal data your organisation processes? If asked, would you be able to explain the grounds on which that personal data is processed? Have you asked for consent, but do you have doubts about the extent to which that permission provides a legally valid basis for processing personal data?

Advice!

Do you want to use our knowledge and call us with some regularity? Subscribe to the Virtual Legal Department. 

Interested? Call or email us:

T. +31(0)70-3819281
E. info@wisemen.nl

For the latest information, subscribe to the newsletter now

WiseMen Newsletter!