GDPR — On what basis you can col­lect per­son­al data?

In the pre­vi­ous blog “Dawn of the GDPR – Are you Ready?” we went through some of the changes that will affect orga­ni­za­tions and how you can pre­pare your busi­ness for the upcom­ing reg­u­la­tions. As described in the blog, com­pa­nies should be able to answer few fun­da­men­tal ques­tions on per­son­al data pro­cess­ing. In this blog, how­ev­er, we will dive deep­er into the ques­tion on what grounds can you col­lect per­son­al data.

“As per Arti­cle 5 in the data pro­tec­tion reg­u­la­tions, per­son­al data should be processed with the prin­ci­pals of, for instance, law­ful­ness, pur­pose lim­i­ta­tion, and data min­i­miza­tion. Data col­lec­tion must be car­ried out on law­ful grounds for a spe­cif­ic pur­pose. This means that data can­not be col­lect­ed with a hope of it being use­ful in the future. There needs to be an explic­it law­ful pur­pose for the col­lec­tion. In Arti­cle 6 of the data pro­tec­tion reg­u­la­tion, six grounds for col­lec­tion, based on which an orga­ni­za­tion can process per­son­al data, have been list­ed. For an orga­ni­za­tion to jus­ti­fy its data col­lec­tion, one of these grounds must be met.

Con­sent of Data Subject

Per­son­al data can be processed if the data sub­ject has freely giv­en an informed and spe­cif­ic con­sent to per­son­al data pro­cess­ing. This ground is not met where the con­sent for data pro­cess­ing is a part of a broad­er con­tract. The request for con­sent, there­fore, needs to be clear­ly out­lined and sep­a­rat­ed from the broad­er contract.

Per­for­mance of a Contract

Per­son­al data can be processed if it is nec­es­sary to per­form a con­tract where the data sub­ject is a par­ty. An employ­ment con­tract between an employ­er and employ­ee is an exam­ple of such a con­tract. It would not be pos­si­ble to per­form an employ­ment con­tract with­out the pro­cess­ing of per­son­al data.

Legal Oblig­a­tion of Controller

The pro­cess­ing of per­son­al data is allowed also when it is nec­es­sary to fol­low data controller’s legal oblig­a­tions. When the ground for pro­cess­ing is a legal oblig­a­tion, the oblig­a­tion must be ground­ed in the leg­is­la­tion of either the Euro­pean Union or its Mem­ber States. For instance, in the con­text of employ­ment, the employ­er must retain and process employ­ee per­son­al data to com­ply with var­i­ous employ­er obligations.

Vital Inter­est or Pub­lic Interest

Per­son­al data can be processed when the pro­cess­ing is nec­es­sary to pro­tect the vital inter­ests of the data sub­ject or of any nat­ur­al per­son. Per­son­al data pro­cess­ing is also allowed when the pro­cess­ing is required to per­form tasks in the name of pub­lic inter­est or offi­cial author­i­ty. Grounds for pro­cess­ing data sub­jects’ infor­ma­tion may be both vital inter­est and pub­lic inter­est. Accord­ing to the pref­ace in the data pro­tec­tion reg­u­la­tion, such pro­cess­ing grounds may be met when attempt­ing to stop the spread of epi­demics or dur­ing human­i­tar­i­an cat­a­stro­phes caused by, for exam­ple, nat­ur­al disasters.

Legit­i­mate interest

Per­son­al data can be processed if the pro­cess­ing is required for the controller’s or a third party’s legit­i­mate inter­ests to be met except in sit­u­a­tions where the data subject’s inter­ests or fun­da­men­tal rights and lib­er­ties take prece­dence over the legit­i­mate inter­ests. This applies espe­cial­ly in the case when the data sub­ject is a child. The grounds for a legit­i­mate inter­est must be con­sid­ered care­ful­ly. For instance, the pro­cess­ing of per­son­al data for mar­ket­ing pur­pos­es is seen to meet the grounds of legit­i­mate inter­est of the controller.

So, when you col­lect data, con­sid­er the neces­si­ty of the data you col­lect and make sure that you meet one of the above grounds to com­ply with the GDPR. When you are sure that your process­es are law­ful, remem­ber to have appro­pri­ate documentation.

Con­tact:
Piia Hoff­sten
Chief Oper­at­ing Officer
piia.hoffsten (a) islet​group​.fi
+358 40 5877 303

#GDPR #dat­apro­tec­tion #cyber­se­cu­ri­ty #datase­cu­ri­ty #Islet­Group