Lawful Processing
The General Data Protection Regulation, or GDPR, sets out strict rules for how companies can conduct lawful processing of the PII of individuals in the European Union.
At the core of these rules is the requirement that all processing of personal data must have a lawful basis. There are six legal bases for lawful processing data under the GDPR.
Companies must determine the appropriate legal basis before processing personal data.
What are the Six Lawful Bases for Processing Personal Data?
The GDPR outlines six lawful reasons to process personal data:
- The data subject has given consent to process their data for a specific purpose.
Processing is necessary to:
- Comply with a legal obligation.
- Protect someone’s vital interests.
- Perform a task in the public interest.
- Legitimate interests of the company, except where those interests are overridden by the rights of the data subject.
Let’s look at a couple of these lawful processing grounds in more detail. Consent is one of the most commonly used legal bases for it.
When relying on consent, it’s critical that it is specific, informed and unambiguous. Pre-ticked boxes or implied consent are not valid under the GDPR.
For example, if a website wants to use cookies to track user behavior for advertising purposes, they would need to get clear, affirmative consent from the user.
A banner that says “by using this site, you accept cookies” would not be sufficient. Instead, the user needs to click on an “I agree” button. They should be informed about what information will be collected and how it will be used before this happens.
Another frequently used lawful basis is legitimate interests. Companies can use personal data without permission if they have a valid reason. This is allowed as long as it does not harm the individual’s rights and interests.
Legitimate interests could include things like marketing, fraud prevention, or IT security. However, companies must balance their interests against the person’s interests.
Legitimate interests cannot be used as the lawful basis if there is a less intrusive way to achieve the same result.
As an example, a company might argue that it has a legitimate interest in analyzing customer data for direct marketing.
However, if a customer has clearly objected to receiving marketing communications, the company’s legitimate interests would likely be overridden by the individual’s right to object.
The company would need to find a different basis for this lawful processing, such as consent, or cease the handling altogether.
Choosing the Right Basis for Lawful Processing
Identifying the lawfulness of each processing activity is crucial for GDPR compliance.
The appropriate lawful processing ground will depend on the specific situation and the purposes of it. In some cases, the basis may be obvious.
One example is when an employer needs to process an employee’s bank details for salary payments. This is done under the legal basis of “necessary for contract.”
Other situations may be less clear cut. Consider a company that wants to process customer info for marketing.
They may be able to use legitimate interests as their lawful basis, arguing that customers would reasonably expect this processing and it has minimal privacy impact.
However, consent may be a safer choice, especially if the marketing involves sensitive topics or if customers would not reasonably expect their information to be used in this way.
Importantly, companies should decide on the basis before beginning lawful processing, and should document their decision. That is not acceptable to look for a lawfulness after the fact.
The lawfulness for processing also affects individuals’ rights. For example, if a company relies on consent, individuals have a stronger right to have their data deleted.
Special Categories of Personal Data
It’s worth noting that the GDPR has special rules for certain sensitive categories of resources, known as “special category data”.
This includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic, biometric or health data.
GDPR prohibits processing of it unless one of the specific conditions in Article 9 of the GDPR applies.
These conditions include explicit consent, necessary for employment law, vital interests, substantial public interest, and more.
The bar for handling special data is much higher, and companies need to be extra careful when handling this type of sensitive information.
For instance, a health app that collects data about users’ medical conditions would be analyzing special category data.
They must get permission from users and have a strong legal reason for analyzing sensitive data.
Common Mistakes in Determining Lawfulness of Processing
A common mistake is thinking that handling data for business purposes automatically makes it legal under the GDPR. However, necessity alone is not sufficient lawfulness.
The lawful processing must fit under one of the six grounds set out in the GDPR.
Another issue is when companies try to rely on lawfulness that doesn’t truly apply.
A company may say refining is necessary for a contract. However, if refining is not crucial for providing the service, the claim is not valid.
Similarly, companies sometimes try to use consent as a “catch-all” legal basis, even in cases where consent is not freely given or where another legal basis would be more appropriate.
A third problem is not being specific enough about the lawfulness. Companies should tie each specific handling activity to lawfulness.
Broad statements like “we process data based on legitimate interests” are not sufficient. The company needs to explain what the legitimate interest is and how it applies to each type of handling.
Best Practices for Ensuring Lawful Processing
To comply with the GDPR’s rules on lawfulness, companies should:
- Map out each of their activities and identify the legal basis for each one.
- When relying on consent, make sure procedures for gaining consent meet GDPR standards.
- When relying on legitimate interests, document how they balanced their interests with individuals’ rights.
- Avoid broad statements about lawfulness and be specific for each distinct processing activity.
- Allow individuals to exercise their rights based on the applicable legal basis.
- Regularly review the activities and legal bases to ensure continued compliance.
Documenting Legal Bases
Documenting lawfulness for each activity is a key part of GDPR compliance. This documentation should explain:
- What PII is being processed
- The purpose of the analyzing
- Which legal basis applies and why
- How the company will uphold individual rights based on the lawfulness
- The company’s legitimate interests assessment (if applicable)
Maintaining and updating this documentation over time is necessary. It’s important evidence of compliance that can be provided to supervisory authorities upon request.
The Importance of Lawful Processing
Determining the basis for lawful processing of information is a cornerstone of GDPR compliance. Companies need a valid legal basis to avoid complaints, access requests, and fines from regulators.
Getting lawfulness right is essential for building trust with customers and avoiding damage to reputation.
Moreover, establishing lawful processing grounds is simply good data hygiene. Companies can improve how they handle information by critically thinking about why they use it and selecting the best legal basis. This process involves considering the purpose of the information and ensuring it aligns with legal requirements.
This lays the groundwork for deriving greater value from resources while respecting individuals’ rights and expectations.
The GDPR’s push for lawful processing ultimately benefits both consumers and businesses. Consumers gain greater transparency and control over how their information is used.
And businesses can operate with greater certainty and build customer confidence. Companies that handle data of EU residents must prioritize establishing lawful reasons for processing PII. This requires investing time and effort.
