Personal data may not be processed without a reason provided for by law. This lesson explains the most common reasons, the role of consent and what the privacy notice (in Italian, informativa) says.
The lawful bases (Article 6 GDPR)
Processing is lawful only if at least one of these six conditions is met:
- Consent of the person.
- Contract: the processing is needed to perform a contract with the data subject or to take pre-contractual steps that the data subject asks for.
- Legal obligation of the controller, for example tax and social-security obligations.
- Vital interests of a person, in serious and urgent cases.
- Public interest or the exercise of official authority (Article 2-ter of the Codice for the Italian rules).
- Legitimate interest of the controller or a third party, if the data subject's rights do not override it. Public bodies do not use it when carrying out their tasks.
The controller chooses the basis before starting. You do not have to choose, but you should know that the purpose for which you use data has a basis and that you cannot change it on your own.
Consent is not always the answer
Consent is valid only if it is freely given, specific, informed and unambiguous, and if the person can withdraw it as easily as they gave it (Articles 4 and 7 GDPR). It is not valid if it is buried in a long text or if the person has no real choice.
In the employment relationship consent is delicate ground: the employee depends on the employer and may not feel free to say no. That is why, to manage the employment relationship, the controller normally relies on other bases, such as the contract and legal obligations, and does not ask for a consent that would not be freely given. If you are asked to sign a generic consent wording "for everything", that is not a good sign: raise it with the privacy contact.
Consent is, by contrast, normally needed to send promotional e-mails or text messages (Article 130 of the Codice). The exception is an e-mail to a customer about products or services similar to those they have already bought, if they were informed and did not object (Article 130(4)). Anyone who does not want sales calls can register their landline and mobile numbers with the Registro pubblico delle opposizioni (the public register of objections).
The privacy notice
Before or at the time of collection, the person must know what happens to their data. This is the privacy notice (Articles 12, 13 and 14 GDPR). It must state, in simple and clear language:
- who the controller is and how to contact it, and the DPO's contact details if there is one;
- for what purposes and on what lawful basis the data is processed;
- to whom it may be disclosed;
- for how long it is kept;
- the person's rights and the right to lodge a complaint with the Garante.
Article 13 applies when the data is collected from the person themselves. Article 14 applies when it comes from other sources.
The controller prepares the privacy notice. Your part is not to say the opposite and to point to the right text: "You will find everything in the privacy notice we give you", and if you do not know it, ask where it can be found.
CVs and employees
Someone who sends a CV on their own initiative does not have to give consent to be assessed. The privacy notice is given at the first suitable contact after it is sent (Article 111-bis of the Codice). For employees, the privacy notice explains, for example, payroll, attendance, IT tools and monitoring.
Minors
For online services offered directly to minors, a minor who has turned 14 can give consent alone; under 14, the consent of whoever holds parental responsibility is needed (Article 2-quinquies of the Codice). This applies to information society services, not to every activity.
To remember
- There must always be a lawful basis; consent is only one of the six.
- At work, consent is rarely the right basis.
- A clear privacy notice before collection; do not change the purpose of the data on your own.