Does An Organisation Need Your Consent To Use Your Personal Data?

An organisation can use your personal data if they have a valid reason to do so. In law, there are six reasons (known as lawful bases) that allow an organisation to use your data, only one of these is actually consent. There are therefore five other bases in which an organisation can use or process your personal data without your consent. These are:

1. Contract

If you have a contract with an organisation, for example if you have purchased goods from them, they may use the contract as a basis to lawfully process your data.

2. Legal obligation

An organisation may rely on this lawful basis if they have to use your personal data to comply with some kind of legal obligation, such as complying with an order of the Court.

3. Vital interests

An organisation would rely on this legal basis if they need to process your data to protect your life or the life of someone else.

4. Public task

This is slightly different than the legal obligation basis and tends to be used by public bodies (such as the NHS or local councils) who need to perform a task in the public interest or as part of its official functions.

5. Legitimate interests

An organisation may be able to use your data if there is a legitimate business interest. In such circumstances, an organisation should only use your data in a way that does not greatly impact you, or if this is not possible, the organisation has a compelling reason for the impact on you.

An organisation has a duty to tell you why they use your data and what lawful basis they are choosing to rely upon. Such information is usually contained within their privacy notice. It is important to note that an organisation must determine a lawful basis before they start processing your data and they cannot simply swap to a different basis without having good reason to do so.

…