Consent And Using Data

• Author: David Zetoony
• Profession: Is a partner in the Boulder, Colorado office of Bryan Cave Leighton Paisner, LLP, an international law firm
• Pages: 23-29

23

consent AnD

UsInG DAtA

Q.30 ARe coMpAnIes ALWAys ReQUIReD

By tHe GDpR to Get opt-In consent

BefoRe UsInG peRsonAL DAtA?

No.

It is a common misconception that the GDPR always requires that

a company obtain the express consent, or “opt-in,” of a person before

collecting or using their data. To the contrary, the GDPR anticipates that

a company may process personal data so long as one (or more) of the fol-

lowing six situations applies:70

1. Consent. Although companies are not always required to get a

data subject’s opt-in consent, if a company obtains a data sub-

ject’s consent it generally is sufcient to allow the company

to process the person’s data. The one exception to this is data

collected in the employment context. The Article 29 Working

Party has echoed concerns raised by many of the data protection

authorities in European Union Member States that the imbalance

in negotiating leverage between an employer and an employee

may cause “consent” of an employee to be ineffective. As a result,

most employers do not base their processing on the consent of

their employees.

2. Necessary to perform a contract. If a company collects personal data

about a person as part of performing a contract with that person,

the company does not have to separately ask for consent. For exam-

ple, if an individual visits an e-commerce site and orders merchan-

dise to be shipped to his or her house, the website is not required to

70. GDPR, Article 6(1)(a)–(f).