In short, no. Consent is only one of the six legal bases for processing. However, any data processing must be legal, that is, based on at least one of the legal issues listed below:

  • consent;
  • concluding or executing a contract;
  • fulfilling a legal obligation;
  • the vital interests of the data subject or other natural person;
  • public interest;
  • the legitimate interest of the operator.

The six legal bases are in a position of equality, but in order for the processing to be legal, for each purpose, at least one legal basis must be identified. If you can accomplish your goals without processing the data, you will not have a legal basis and the processing will be illegal.

If you process sensitive data or data on criminal convictions or offenses, you will have to observe, in addition to the six above-mentioned grounds, other conditions for the processing of these categories of data referred to in (9) a and art. (10) of the Regulation.

Since obtaining a valid consent is not an easy task for the operator, as well as the fact that the person can withdraw his consent at any time, and further processing on another legal basis is not a practice accepted by the Regulation, we recommend recourse to other legal grounds , and only if they have been exhausted, the use of consent.

To the extent that you wish to rely on legitimate interest as a basis for processing, you will need to carry out a balancing test to show that the legitimate interest overrides the rights of the data subject.