Lawful bases for processing
The six grounds of article 6, the qualities of valid consent and its withdrawal, the rule on trackers and what the choice of ground entails: justifying a processing operation and spotting consent that is worth nothing.
- 21 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
Lawful basis: what is it?
Show the answer
The justification, among six provided by article 6, without which processing personal data is unlawful.
Consent, contract, legal obligation, vital interests, public task, legitimate interest: one is chosen before collecting, per purpose, and is not swapped afterwards.
Which tracker may be placed without asking for consent?
- The one that keeps the basket contents during the session
- The one that remembers interests to target the advertising
- The one set by a social network's share button
- The one from an analytics tool that cross-references visits with other sites
Show the answer
The one that keeps the basket contents during the session
Only trackers strictly necessary for the requested service are exempt: basket, authentication, security. Advertising, social sharing and cross-site matching require consent.
The six lawful bases are …, contract, legal obligation, vital interests, public task and ….
Show the answer
The six lawful bases are consent, contract, legal obligation, vital interests, public task and legitimate interest.
The list is closed: "we have always done it this way" is not one. Delivering an order falls under contract, keeping invoices under legal obligation.
Consent: what is it?
Show the answer
A free, specific, informed and unambiguous indication of wishes by which the person agrees to the processing through a statement or a clear affirmative act.
A pre-ticked box or silence is not consent. The person may withdraw it at any time, as easily as it was given; past processing remains lawful.
An employer has employees sign a consent form for geolocating their company vehicle. What is the flaw and which ground is sounder?
- Consent is not free under subordination; a proportionate, announced legitimate interest
- Consent not specific enough; separate consent for each trip
- Consent not informed; a longer notice is enough to validate it
- No flaw; the employee's signature counts as contract and consent
Show the answer
Consent is not free under subordination; a proportionate, announced legitimate interest
The employee cannot refuse without fear: their consent is not free. The employer relies instead on legitimate interest, staying proportionate and informing them.