GDPR: Do you always need consent?

By 29th April 2018B2B, Blog, GDPR, Outsourcing

With the new GDPR (General Data Protection Regulation) soon to be implemented, there are a lot of questions around the need for consent and if you can process data If you haven’t obtained it.

GDPR focuses on the processing of personal data, many sources have advised that consent is always necessary to allow processing, however consent only makes up one of six lawful grounds for processing data under GDPR, and in reality, you will have to obtain consent only if none of the other five grounds are applicable.

GDPR clearly defines consent, it states that for lawful consent, it must be given with a clear affirmative action. Essentially, giving people the option to unsubscribe or automatically opting them into marketing communications simply isn’t going to allow you to demonstrate consent. Furthermore, consent requests have to be an ‘affirmative action’ which means silence, lack of engagement, default bias or default settings won’t be a lawful demonstration of consent.

However, as we said before, consent is only one of six lawful grounds.

The other lawful grounds are:

  • Compliance with a legal obligation – Some data such as employee records must be kept for compliance with other UK laws.
  • A contract with an individual – This could be an employment contract or a contract to supply goods/services.
  • A public task – Where an activity is being carried out in the public interest, this will cover all government authorities and departments.
  • Vital Interests – Where the data is essential to maintain someone’s wellbeing (Either the data subjects or someone else’s)
  • Legitimate Interest –  Where an organisation in the private sector has a genuine and legitimate reason to process personal data, this can include personal benefit, however organisations must undertake a balancing test to ensure the data subjects rights and freedoms aren’t negatively impacted.

As you can see from the above there are a number of ways in which personal data can be processed under GDPR. Consent is always going to be important however when looking at B2B Marketing and the services agencies such as Prospect Research offer like B2B Telemarketing, Lead Generation and Market Research Legitimate Interest is incredibly important. The key to ensuring compliance is carrying out a robust and non-biased balancing test to ensure you are processing the data in the most appropriate way and that your activity won’t negatively impact the data subject in any way.

GDPR is all about giving individuals more control over data held about them, however consent is only one of the lawful grounds and the other 5 must be understood to avoid frustration and ineffective marketing campaigns.

If you want to find out more, get in touch below.