{"id":18886,"date":"2024-04-15T09:06:00","date_gmt":"2024-04-15T08:06:00","guid":{"rendered":"https:\/\/www.rosello-mallol.com\/?p=18886"},"modified":"2024-04-13T07:36:10","modified_gmt":"2024-04-13T06:36:10","slug":"legal-basis","status":"publish","type":"post","link":"https:\/\/www.rosello-mallol.com\/en\/legal-basis\/","title":{"rendered":"The legal basis for the processing of personal data"},"content":{"rendered":"\n

In the world of data protection, one of the fundamental issues is the legal basis upon which the processing of personal data is carried out. Within the framework of the General Data Protection Regulation<\/strong> (GDPR) of the European Union, there are several legal bases (Art. 6 GDPR) that allow organizations to collect, use, and share personal data in a legal and ethical manner. In this post, we will explore the different legal bases and their importance in data processing. Understanding and applying them correctly is essential for fulfilling other basic obligations such as data retention periods, drafting privacy policies, preparing the records of processing activite<\/a>s<\/a>, etc.<\/p>\n\n\n\n

Below we outline the legal bases applicable to private entities:<\/p>\n\n\n\n

Consent of the Data Subject: the most common legal basis.<\/h2>\n\n\n\n

Consent is one of the most well-known and commonly used legal bases for the processing of personal data, although not the only one<\/strong>. According to the GDPR, consent must be freely given, specific, informed, and unambiguous, and individuals have the right to withdraw their consent at any time. It is important for organizations to obtain clear and explicit<\/strong> consent, never implied, before processing individuals’ personal data.<\/p>\n\n\n\n

Although not the only legal basis, the lack of consent for data processing is often a major argument of the Spanish Data Protection Agency for imposing sanctions. A recent example is Orange being fined<\/a> <\/strong>for providing an unauthorized third party with a copy of a SIM card without the holder’s consent.<\/p>\n\n\n\n

Performance of a Contract to Which the Data Subject is a Party<\/h2>\n\n\n\n

Another legal basis for data processing is the performance of a contract. When data processing is necessary to fulfill a contract<\/strong> to which the individual is a party, no additional consent is required<\/strong>. However, the processing must be necessary for the performance of the contract and related to it.<\/p>\n\n\n\n

Compliance with a Legal Obligation<\/h2>\n\n\n\n
    <\/ol>\n\n\n\n

    Data processing may also be necessary to comply with a legal obligation to which the organization, company, or entity is subject to. This includes situations where processing is necessary for compliance with legal or regulatory obligations, such as fulfilling labor or tax obligations.<\/p>\n\n\n\n

    Legitimate Interest: the legal basis for marketing to existing customers.<\/h2>\n\n\n\n
      <\/ol>\n\n\n\n

      Data processing may also be based on the legitimate interests pursued by the organization. However, it is important to balance these interests<\/strong> with the fundamental rights and freedoms of individuals. Organizations must conduct a Data Protection Impact Assessment (DPIA) to determine if their legitimate interests outweigh the privacy rights of individuals.<\/p>\n\n\n\n

      Among the legitimate interests as a legal basis is the use of data for marketing purposes, in relation to existing customers and to offer similar products or services from the same company with which there is a contractual relationship.<\/p>\n\n\n\n

      Protection of Vital Interests<\/h2>\n\n\n\n
        <\/ol>\n\n\n\n

        In situations where data processing is necessary to protect the vital interests of the individual or another natural person, this legal basis may apply. For example, in cases of medical emergencies or life-threatening situations, organizations may process personal data without consent to protect the health and safety of the individuals involved.<\/p>\n\n\n\n

        Conclusion<\/h2>\n\n\n\n

        In summary, understanding the legal basis for data processing is essential to ensure compliance with data protection regulations and protect the privacy rights of individuals. By selecting the appropriate legal basis, organizations can ensure that their data processing is transparent, ethical, and legally sound.<\/p>\n\n\n\n

        If you need more information, contact us!<\/p>\n\n\n\n

        \n
        \n

        <\/p>

          <\/ul><\/div>\n
          \n
          \n<\/fieldset>\n