3 ms·
Part of that is because consent is only one of the 6 ways to claim compliance for data processing, and is not always the appropriate way to be compliant. In fac
by arcbyte 8y ago
Part of that is because consent is only one of the 6 ways to claim compliance for data processing, and is not always the appropriate way to be compliant. In fact, most people who are using the word "consent" are wildly misinterpreting the GDPR, using "consent" as a catchall term, when in fact the GDPR takes a far narrower view.
The legal basis that is probably FAR more important but isn't being talked about is the contractual basis, and there are two. When I say people are overusing "consent", I mean that entering into a contract requires ~consent~ in loose everyday conversation, but is actually not "consent" for the purposes of the GDPR - its a contract.
Because of the difference between the loose meanings in everyday conversation and the (slightly) more precise definitions in the GDPR, you are seeing a LOT of articles push back on using the consent basis for compliance because what you are actually talking about, in GDPR terms, is a contractual basis, or a "legitimate use" basis attached to a contractual basis.
Most online businesses view their Terms of Service as establishing a contract. Therefore, no "consent" required because you using their website is a contract, even though in loose conversation you would say that you ~consented~ to enter that contract.
The document you posted is consistent in trying to hammer home the distinction. Read this excerpt:
> The ‘consent’ is a condition of service
If you require someone to agree to processing as a condition of service, consent is unlikely to be the most appropriate lawful basis for the processing. In some circumstances it won’t even count as valid consent.
Instead, if you believe the processing is necessary for the service, the better lawful basis for processing is more likely to be that the “processing
is necessary for the performance of a contract” under Article 6(1)(b). You are only likely to need to rely on consent if required to do so under another provision, such as for electronic marketing.
It may be that the processing is a condition of service but is not actually necessary for that service. If so, consent is not just inappropriate as a lawful basis, but presumed to be invalid as it is not freely given. In these circumstances, you would usually need to consider ‘legitimate interests’ under Article 6(1)(f) as your lawful basis for processing instead.