Legal bases and consent for processing personal information
Legal bases and consent
This domain tests the lawful basis for each processing operation, with consent as the most examined basis. You need to distinguish general consent, separate consent and guardian consent, and know when consent is not the right basis.
The legal bases
Article 13 permits processing where:
- the individual has given consent;
- processing is necessary to conclude or perform a contract to which the individual is a party;
- processing is necessary to perform a statutory duty or obligation;
- processing is necessary for public health or protection of life, health or property in an emergency;
- processing is within a reasonable scope for news reporting or public opinion supervision for the public interest;
- personal information has been lawfully disclosed and is processed within a reasonable scope under this Law;
- other laws or administrative regulations provide a basis.
Consent must be informed, voluntary and explicit. Where the purpose, method or type of information changes, fresh consent is needed. Withdrawal must be as easy as giving consent.
Separate consent
Separate consent is required to provide personal information to another processor, to publicly disclose it, to process sensitive personal information, and to transfer it abroad. Processing sensitive information also requires specific purpose and strict necessity. For a minor under 14, the guardian must give consent, and a special processing rule applies.
Worked example
A hospital app collects health data for appointment reminders. Health data is sensitive, so the hospital needs separate consent, a specific purpose and strict necessity. Reminders may also be necessary to perform the appointment contract, but the hospital cannot use that basis to bundle in marketing. Sharing the data with a marketing partner needs separate consent. If a user refuses marketing, the hospital must not deny the appointment service if marketing is not necessary to it.
Traps
Silence or pre-ticked boxes are not consent. Bundled consent for several unrelated purposes fails. Consent is not needed where another Article 13 basis genuinely applies, but a processor cannot manufacture a contractual necessity to avoid consent. Guardian consent is required for under-14 users; parental notice alone is not enough.