Question 1

Do we always need consent to process personal data?

Accepted Answer

No. Consent is one of six lawful bases in Article 6, alongside performance of a contract, legal obligation, legitimate interests, vital interests and public task. Treating consent as the default causes real problems: it is the most fragile basis because it can be withdrawn at any time, and asking for permission you would override if refused is worse than choosing the correct basis.

Question 2

What is the legitimate interests balancing test?

Accepted Answer

Three questions that must all pass. Purpose: is there a real, specific interest? Necessity: is the processing actually needed, or would a less intrusive method achieve the same aim? Balance: do the individual's rights and reasonable expectations override that interest? The reasoning must be documented before processing begins, and the test is designed to be capable of failing.

Question 3

Can an employer rely on employee consent for workplace monitoring?

Accepted Answer

Almost never. Consent must be freely given, and an employee who refuses risks their job or standing, so the imbalance of power means the consent is not free. Putting it in an employment contract makes it worse rather than better. Consent also cannot rescue processing that has already failed the necessity test.

Question 4

Can we reuse data we already hold for a new purpose?

Accepted Answer

Not automatically. The lawful basis attaches to the purpose, not to the act of collection, so a new purpose needs its own basis decided in advance. Purpose limitation under Article 5 prevents quietly widening what data was collected for, which is why keeping job applicants' CVs for future roles needs its own basis rather than inheriting the original one.

Question 5

Is telling people about processing enough to make it lawful?

Accepted Answer

No. Transparency is a separate obligation that sits alongside a lawful basis, never instead of one. Informing people about processing that has no valid basis simply means they are aware of something unlawful. Both are required independently.

Question 6

Which principle is broken by keeping data with no retention period?

Accepted Answer

Storage limitation. Article 5 requires personal data to be kept in identifiable form no longer than is necessary for the purpose, which means a retention period decided in advance. A period that ends only when somebody complains, or an open-ended just in case, does not satisfy it.

Принципи та правові основи

Що таке Принципи та правові основи?

Що ви дізнаєтесь у Принципи та правові основи

Принципи та правові основи — Кроки навчання

Людина, яку люди запитують

Басейн талантів

Довідковий аркуш

Вибір талантів

Відповідаючи Томасу

Функція «Рекомендації».

Згода чи щось інше

Продукт відповіді

Спостерігаючи за надомниками

Тест із трьох частин