Q&As

What’s the impact of failing to obtain a valid consent under the GDPR? Can you use a privacy notice to make up for a defect in such a consent?

read titleRead full title
Published on LexisPSL on 01/03/2019

The following Information Law Q&A provides comprehensive and up to date legal information covering:

  • What’s the impact of failing to obtain a valid consent under the GDPR? Can you use a privacy notice to make up for a defect in such a consent?
  • Requirements for lawful processing of personal data
  • Requirements of obtaining valid consent
  • Penalties for failing to obtain valid consent
  • Can you change lawful basis?
  • Further reading

Requirements for lawful processing of personal data

An organisation cannot simply process personal data because it wishes to do so. It can only process personal data if it satisfies one of the conditions set out in Article 6(1) of Regulation (EU) 2016/679, General Data Protection Regulation (GDPR). These are commonly known as the ‘lawful grounds’, ‘legitimate grounds’ or ‘conditions’ for processing.

Under the GDPR, there are six potentially lawful grounds for processing personal data, as set out in Practice Note: Processing personal data—lawful processing:

  1. the data subject has given consent to the processing of their personal data for one or more specific purposes—see section in the above Practice Note: Processing personal data—lawful processing—Consent

  2. processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject before entering into a contract—see section in the above Practice Note: Processing personal data—lawful processing—Performance of a contract

  3. processing is necessary for compliance with a legal obligation to which you are subject—see section in the above Practice Note: Processing personal data—lawful processing—Compliance with a legal obligation

  4. processing is necessary to protect the vital interests of the data subject or another natural person—see below in the above Practice Note: Processing personal data—lawful processing—Vital interests of the data subject or of another natural person

  5. processing is necessary

Popular documents