Blog: One of the strongest myth when it comes to legal processing of personal data, are the myth(s) surrounding consent:
- If you have consent, it is always legal to process personal data. That is not correct. Consent is one of the options that may provide for legal processing of personal data in accordance with article 6 or 9. However, you still need to have a legitimate and fair purpose and legal processing must also be proportionate, all in accordance with article 5.
- You shall always have permission to process personal data. That is not correct. You may be required to process personal data due to a legal obligation, due to contractual obligations or even if you can demonstrate legitimate interest. The GDPR provides for several other options that may provide for legal processing of personal data, even sensitive data, without consent or permission.
These myths continue to live which is partly because the two-sided assessment of legal processing (legitimate/fair purpose, see article 5, AND legal foundation in primarily article 6 or 9) is so difficult for even legal people to grab.
The journalists try very hard to bring light to the complicated area but by doing that they also add to the misunderstandings.
Recent example – Jim Chisholm in PressGazette 19/9/2017 in Why European Union’s General Data Protection Regulation directive could save the journalism industry:
The principle behind GDPR is that every individual must provide permission for their personal data to be used, in context and form. Every database holder must demonstrate such permission and also permission for that data to be shared with another holder.
That is not correct. You do not need permission from every individual for their personal data to be used or shared with another holder. It may in some instances be required but that is not the principle behind legal processing in accordance with GDPR.
Why I am not sure I can agree with Mr. Chisholm that the GDPR will save the journalism industry if his article represent accuracy and quality in journalism.