Principles of Data Processing

Principles of Data Processing - Steven L. Mandell

This section presents the seven principles governing the processing of personal data and set out in article 5 of the GDPR: (1) lawfulness, fairness and transparency; (2) purpose limitation; (3) data minimisation; (4) accuracy; (5) storage limitation; (6) integrity and confidentiality; (7) accountability.

Lawfulness, fairness and transparency

Lawfulness

Processing is lawful if it is based on one of the legal grounds listed in art. 6 of the GDPR. The most prominent of these legal grounds is consent, but other grounds are also available, including legitimate interest.

Consent is "any freely given, specific (cf. below), informed and unambiguous indication of the data subject’s wishes by which he or she (...) signifies agreement to the processing". Consent can be express (i.e. by a written or oral statement, including by electronic means, where it is often signified by ticking a box) or implied (by an affirmative action). Silence or inaction (e.g. a pre-ticked box) cannot be interpreted as consent.
Consent can be withdrawn at any moment, but this withdrawal is not retroactive (i.e. it does not affect the lawfulness of the processing prior to the withdrawal).
For processing of data relating to minors under the age of 16, consent needs to be given or authorised by the holder of parental authority. Member States may lower this "age of consent", but not below 13 years of age.

When it comes to processing of sensitive data, consent must be explicit (i.e. no implied consent possible).

For more information about consent, consult these Guidelines.

Alternatively, processing can also be based on one of alternative grounds for lawfulness listed in art. 6 of the GDPR. From the point of view of research, the most important of these alternative grounds is art. 6 (1) (f) according to which processing is lawful if it is "necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject". It is therefore a "balance of interests" test: processing is lawful if the legitimate interests (personal, scientific or societal) pursued by the controller (or by a third party) outweigh those of the data subject in protecting his/her privacy. This must be evaluated on a case-by-case basis, taking into account such elements as the category of data that are being processed, the reasonable expectations of the data subject and the implemented safeguards (such as pseudonymisation). This ground for processing should only be subject to careful assessment.

For more information about legitimate interest, see these Guidelines.