No. You don’t always need consent to use personal data. You can use it without consent if you have a valid reason. These reasons are known in the law as a ‘lawful basis’, and there are six lawful bases you can use.
What counts as a valid reason or ‘lawful basis’?
Consent
Contract
Legal Obligation
Vital interests
Public task
Legitimate interests
When can you rely on an individuals consent?
If you want to use this as the reason for using personal data, you need to ask for permission. You must ask in a way that can be clearly understood, explains exactly what you will do, and is separate from your other terms and conditions. You need to advise the subject of all the organisations that will be relying on the consent and ask to take an action to give permission. This action has to be positive, for example ticking a box. You cannot use pre-ticked boxes.
You should give a genuine free choice about whether a subject consents and you need to make the subject aware that they can take away their consent at any time.
Example
Company Z asks if someone would like to receive a newsletter by email from their partner company, Company Y. This is entirely optional but they decide they do want to receive Company Y’s newsletter so they tick the box provided. The lawful basis being used in this instance is consent.
If you ask someone to agree to something does this mean they are consenting?
Not necessarily. There will be lots of times when someone has given you personal data and you ask them to agree to something or give their permission for something that is unrelated to data protection consent. For example, someone may agree to sign a contract with you, or agree to your terms and conditions but this doesn’t mean you will be using consent to process their data. Consent must be separate from other things.
Sometimes organisations have other legal or ethical reasons they have to get ‘consent’ to do something but this doesn’t mean you always need consent to use personal data.
Example
A GP tells someone they want to refer them to the care of a specialist doctor. So they don’t breach confidentiality, they have to have consent to share medical records. This is related to rules within the health sector.
However, this doesn’t mean the GP is using consent as the lawful basis to use personal data. In this situation, public task, vital interests or legitimate interests are more likely.
Can you send marketing without consent?
Yes, in some circumstances you might not need consent to send out marketing.
If you want to send marketing out electronically (for example by email, text message, some phone calls) e-privacy laws may require you to have consent.
However if e-privacy laws don’t require you to get consent, or the marketing is by post, you may be able to use one of the other lawful bases instead.
Example
Last month someone made a one-off donation to a charity and as part of this gave the charity their address. The charity decides that it has a legitimate interest to process the address details to send out a fundraising letter by post. It believes that the individual would reasonably expect to hear from them and that the privacy impact on them is minimal but it includes details of how to opt-out within the mailing. The charity relies on the legitimate interests basis to send the fundraising mailing out.
What is the contract basis?
You might use this reason if you have a contract with an individual, or because they have asked you to take certain steps before they start a contract with you.
Example
Someone buys a sofa from an online furniture store. As part of their contract with them, the furniture store agrees to deliver the sofa. The store needs to use their address so they can deliver the sofa to them. Because using their address for this reason is necessary to fulfil the contract it uses the contract lawful basis.
What is the legal obligation basis?
An organisation might use this to protect an individuals life or the life of someone else.
Example
Someone is admitted to the A & E department of a hospital with life-threatening injuries following a serious accident. Sharing their medical records with the hospital is necessary in order to protect their life, therefore it uses vital interests.
What is the legitimate interests basis?
You might be able to use personal data for legitimate business interests.
Legitimate interests is likely to be used in situations where you are using personal data in ways you would reasonably expect and which are low-risk and won’t have a big impact on an individual, or if you have a compelling reason for the impact.
An individual can object to the use of their data when you are using this basis, which means you would have to think about whether you should be using their data and, if you decide to continue using it, give a very strong reason to justify why.
Example
Your sister is asked by her employer for the contact details of a relative in case she has an accident or becomes seriously ill at work. She gives her employer your contact details because she wants you to be her emergency contact.
Her employer considers that being able to contact you in an emergency is a legitimate interest as a responsible employer and that it’s also in the interests of both your sister and you that you’re told about the emergency.
As your contact details will only be accessed in an actual emergency and the impact of holding those details is very low, the employer decides that it can rely on legitimate interests to process your details.
Privacy Notice
You must tell individuals why you use their data and what your valid reason or lawful basis is for this.
You need to make this information available in your privacy notice. Your privacy notice must detail why you are using personal data and which of the six lawful bases is the reason you are using personal data
Often you will be processing personal data for a variety of purposes so you may be relying on more than one lawful basis. However, all the bases you are relying on must be included in your privacy notice.
