According to the General Data Protection Regulation (GDPR), an entity must have a "valid lawful basis" to process personal data. If you can process data without handling any personal information of the user, then continue that way. If not, the law defines six lawful reasons for processing personal data:
- Consent
- Contract
- Legal Obligation
- Vital Interest
- Public Task Interest
- Legitimate Interests
No one basis is more important than the other or should be viewed as the path of least resistance. The basis you should operate under will come down to your purpose for processing personal data and the ongoing relationship you plan to have with the data subject.
However, one of the six is more complex to implement than the others, but it is also likely to engender the most trust: consent. Gaining consent should put the power in the hands of an individual so that they have a real and genuine choice about how their personal data is used and processed. That is backed by the GDPR requiring "positive opt-ins," so no methods of default consent are allowed.
This approach presents advantages. Giving the individual control to make their own choice engenders trust and can enhance an organization's reputation because there is nothing hide, so to speak. In a world with long privacy notices and abundant product notifications, your clients may find an open and honest approach to consent to be refreshing.
A checklist to help you take the right approach when it comes to consent should include the following actions.
Try to ensure:
- The request for consent is separate and conspicuous. (Note: As a controller, you should seek consent prior to any personal data collection, and as a processor, you should seek consent prior to any personal data processing. So, know and understand which role you are operating as for each process, either a controller or a processor.)
- Consent is the most appropriate lawful basis for processing someone's personal data.
- You ask people to positively opt in and that you are not using any methods of default consent.
- Any associated language you use while asking for consent is clear and easy to understand, including informing individuals that they can withdraw their consent.
- Clients can just as easily withdraw their consent at any time as they can provide it.
- You clearly explain why you want someone's data and what you plan to do with it.
- Individuals can refuse to consent without impact or detriment and that there are no preconditions around consent being required as part of a service.
- You provide options to consent separately for different types of processing.
As you can see, there is a lot to consider, including what to do if you offer online services to children or how will you record consent, so careful planning is a must. Individuals also have certain rights under the GDPR which you should consider when following the consent path as a lawful basis, including the right to restrict processing, erasure and the right to be informed.
Obviously before you can do any of this, you need to know where your data flows and what is subject to the GDPR. Trustwave can help with a range of offerings, including workshops, risk assessments, privacy assessments and more.
Brian Odian is managing consultant of global compliance and risk services.