4 ms·

If they're actually legitimate they don't need to ask for consent, they are two separate lawful basis for processing data.

• jacquesm 5y ago
  They're not.
  • thecopy 5y ago
    They are (according to GDPR.)
  • bulatb 5y ago
    The lawful bases for processing data are listed in Article 6. Subject consent is 6(1)(a) and legitimate interest is 6(1)(f). Consent is used when processing is not required to provide the service, no other basis applies, the processor still wants the data anyway, and the subject agrees. Legitimate interest applies when data isn't needed to provide the service but is necessary for related business functions (like fraud detection) not covered by another basis. No basis except 6(1)(a) requires the subject's consent because the rest all cover processing required for the service to work. https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ === Edit: I read "They're not" as "the bases aren't separate." On rereading, it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not. I'll leave this up in case it's useful to someone.
    • jacquesm 5y ago
      > it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not. That was the point. Then to force your users to consent adds insult to injury and is in contravention to the GDPR.