Legal Basis Myth Buster

Choosing a legal basis for processing can sometimes be a confusing business and, over time, a few myths have developed, so let’s distinguish fact from fiction:

1. Consent is the best lawful basis

False. Consent may not always be the answer. It is a lawful basis for processing, but it is not the only one and there may be more appropriate alternatives for your processing. For example, where a retailer needs a customer’s address to deliver a product they have purchased, contractual necessity would be more appropriate than consent. If consent was used and the customer later withdrew the consent, the retailer would be unable to fulfil its contractual obligations to deliver the product.

2. If we can’t think of a legal basis we should just say it is legitimate interests

False. Legitimate interests should not be seen as a “catch all” category. It is important to make a case-by-case assessment of the most appropriate legal basis for your processing and to remember that using legitimate interests requires you to undertake an assessment to ensure that the rights and freedoms of individuals do not override the legitimate interest you have identified.

3. Vital interests covers anything that is really important

False. Vital interests are those which are essential for someone’s life. It is particularly relevant for emergency medical care and is only applicable where an individual is physically or legally unable to give consent.

4. If we change our mind, we can just change the legal basis at a later date

False. You should not swap from one legal basis to another without a good reason and you cannot usually change the legal basis if the processing is based on consent.

5. “Legal basis is just for our internal records”

False. You will need to include information about legal basis in your privacy notice as part of your transparency obligations, whether you collect the data from the individual or from another source.

6. There are extra rules for special category data and criminal offence data

True. When you process special category data (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation) as well as having a legal basis under Article 6 of the UK GDPR, you also need to be able to comply with one of the conditions for processing set out under Article 9 UK GDPR. With regard to criminal offence data, you will need to identify a basis for processing under the Data Protection Act 2018 in addition to a basis under Article 6 of the UK GDPR.