Tag: law

Lawful Basis: Contract

There is a lawful basis for personal data processing when the personal data of an individual is required to fulfill a contract obligation or when the individual asks an organization to do something before entering in a contract.
This does not apply when it is reasonably possible to achieve the same goal without processing the personal data.
As always, the action should be documented for justification about the why and how the personal data was gathered and processed.

Contracts

When the personal data processing is required for a contract with an individual, a separate consent is not required.
This is quite simple and straightforward.

When in a special category data is necessary for the contract, then it is also required to identify a separate condition for processing this data.

When the contract is with a child under 18, the organization must consider whether they have the necessary competence to enter into the contract. When in doubt, another lawful basis could be applied, for instance, legitimate interests if it demonstrates that the child’s rights and interests are properly considered and protected.

Rights

When personal data is being processed on the basis of contract, the individual’s right to object and the right not to be subject to a decision based solely on automated processing does not apply. However, the individual has the right to data portability.

Need Help with GDPR?

Get in touch with us if you need help on the subject.

Basis for Personal Data Processing

GDPR enforces organizations to have a valid lawful basis in order to process personal data.
There are six lawful bases, all equal in importance, though the selection of which basis is the most appropriate to use will depend on the organization purpose and its relationship with people.

The lawful basis must be determined before the data processing begins because it should be documented along with the purposes of the data processing, and included in the privacy notice accepted by the individuals. This makes it clear for the people to know what they are consenting.

If the purposes change, unless it is compatible with the initial purpose, it will require a change of the lawful basis, and it could be necessary to redo the processes of documentation, consenting, etc..

Lawful Bases for Data Processing

The six lawful bases for personal data processing are defined in Article 6:

  • the data subject has given consent to the processing of their personal data for one or more specific purposes;
  • processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
  • processing is necessary for compliance with a legal obligation to which the controller is subject;
  • processing is necessary in order to protect the vital interests of the data subject;
  • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • processing is necessary for the purposes of the legitimate interests pursued by a controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This shall not apply to processing carried out by public authorities in the performance of their tasks.

Processing activities that fall under performance of a contract, legal obligation, vital interests and public task may be fairly straight-forward to identify. The key for many will be assessing whether Consent or Legitimate Interests will be most appropriate for specific processing of personal information.

Processing Special Category Data

When processing special category data organizations need to identify both a lawful basis for the general processing and an additional condition for processing this type of data.

Criminal Data Processing

When processing criminal conviction data, or data about offenses, it is necessary to identify both a lawful basis for general processing and an additional condition for processing this type of data.

Need Help with GDPR?

Get in touch with us if you need help on the subject.