Personal data cannot be processed however you like. Article 5 of the GDPR sets out seven principles that guide every task. When you are not sure what to do, go back over this list.
The principles in article 5
- Lawfulness, fairness and transparency. There must be a lawful basis, nobody is misled, and it is explained clearly what is done with the data.
- Purpose limitation. Data is collected for a specific purpose and is not later used for another, incompatible one. Data from a job application form cannot be used to send advertising.
- Data minimisation. Only the data that is needed is requested and used. If the name is enough, the date of birth is not requested as well.
- Accuracy. Data must be up to date. If someone points out a mistake, it is corrected.
- Storage limitation. Data is not kept for ever, but only for as long as it is needed or a law requires.
- Integrity and confidentiality. Data is protected against unauthorised access, loss and destruction.
- Accountability. The company must be able to show that it complies, with documents, records and procedures.
The bases that allow data to be processed
To process data, at least one of the bases in article 6 of the GDPR is needed:
- the person's consent
- the performance of a contract, for example the employment contract
- a legal obligation, such as reporting data to Social Security
- the protection of a person's vital interests
- a task carried out in the public interest or the exercise of official authority
- a legitimate interest of the company or of a third party, as long as the person's rights do not override it
For a company, most staff data is processed because of the contract and legal obligations: payroll, registrations, contributions and tax withholdings. Asking staff for consent is rarely a good basis, because the worker depends on the company and may not feel free to say no.
Consent
When consent is the basis, it must be freely given, specific, informed and unambiguous, given by a clear statement or action. A box that is already ticked, or silence, does not count. The person can withdraw it at any time, and withdrawing must be as easy as giving it.
The age of minors
Article 7 of the LOPDGDD sets 14 years as the age from which a minor can consent to the processing of their own data. Below that age, the consent of whoever holds parental authority or guardianship is needed. This matters in academies, sports clubs, schools and companies that offer services to families.
The information that must be given
When data is collected, the person must be told (articles 13 and 14 of the GDPR): who the controller is, what the data is used for, on what lawful basis, who it is passed to, how long it is kept and what rights the person has. The LOPDGDD (article 11) allows this to be done in layers: basic information in plain view and the rest somewhere easy to find, for example a web address.
Remember: if you are going to use data for something new that was not explained to the person, ask the right person in your company first.