GDPR · Domain 1
Principles & Lawful Basis
About 20% of the exam
The Article 5 principles
- Lawfulness, fairness, transparency
- justified, expected and clearly explained
- Purpose limitation
- collected for specified explicit purposes
- Data minimization
- adequate, relevant and limited
- Accuracy
- kept correct and up to date
- Storage limitation
- kept no longer than needed
- Integrity and confidentiality
- known as the security principle
- Accountability
- demonstrate compliance, not merely achieve it
Accountability sits in Article 5(2) and shifts the burden of proof onto the controller in any investigation or complaint
The six lawful bases
- Consent
- freely given, specific, informed, unambiguous
- Contract
- necessary to perform or enter one
- Legal obligation
- required by Union or national law
- Vital interests
- life or death, often another person
- Public task
- official authority or public interest function
- Legitimate interests
- balanced against the individual's rights
Public authorities cannot rely on legitimate interests for processing carried out in the performance of their tasks
What makes consent valid
- Freely given, without a power imbalance
- Specific to each separate purpose
- Informed before the box is ticked
- Unambiguous clear affirmative action
- Pre ticked boxes never count
- As easy to withdraw as give
- Controller must be able to demonstrate it
Special category data
- Article 9 prohibits processing by default
- Race, ethnicity, politics, religion, union membership
- Genetic, biometric, health, sex life, orientation
- Needs an Article 6 basis too
- Consent here must be explicit
- Legitimate interests is not an Article 9 condition
Legitimate interests assessment
- Identify the interest
- Purpose test
- Necessity test
- Balancing test
- Document the outcome
- Name it in the notice
- Individual rights can override the interest
- Reasonable expectations shape the balance
- Children weigh heavily against the controller
Territorial scope, Article 3
- Establishment in the Union processing personal data
- Offering goods or services to people here
- Monitoring behavior that takes place here
- Location of the servers is irrelevant
- Outside controllers may need a representative
Purpose limitation and compatibility
- A new purpose needs a compatibility assessment
- Article 6(4) lists the factors
- Link between original and new purpose
- Context and the relationship with people
- Nature of the data, especially special categories
- Possible consequences for the individual
- Safeguards such as encryption or pseudonymization
- Archiving, research and statistics are presumed compatible
Commercial advantage to the controller is never a compatibility factor, and consent based processing needs fresh consent rather than an assessment
Personal data, defined
- Personal data
- relates to an identifiable living person
- Identifiable
- singled out directly or indirectly
- Online identifiers
- cookies, device ids, network addresses
- Pseudonymized
- still personal data, still in scope
- Anonymous
- outside the regulation entirely
- Filing system
- structured set accessible by criteria
Children
- Digital consent age is sixteen
- States may lower it to thirteen
- Parental authorization below the national age
- Reasonable efforts to verify the holder
- Notices written in language children understand
Accountability evidence
- Records of processing under Article 30
- Policies, notices and retention schedules
- Training records and awareness campaigns
- Legitimate interests assessments kept on file
- Impact assessments before high risk starts
- Written contracts with every processor
Fairness in practice
- No hidden or unexpected secondary uses
- Dark patterns undermine the fairness principle
- Consent fatigue is a design failure
- Self service tools support accuracy
- Plain language beats legal boilerplate
- Layered notices help without hiding detail
Where lawful bases go wrong
- Consent used where refusal costs service
- Contract stretched to cover targeted advertising
- Legal obligation claimed for discretionary processing
- Legitimate interests chosen without a balancing test
- Switching basis once a complaint arrives
- One basis claimed for many purposes
Choosing a basis, step by step
- Define the purpose precisely
- Check whether processing is necessary
- Test each Article 6 basis
- Add an Article 9 condition if needed
- Document the choice
- Publish it in the notice
- The basis is fixed before collection
- Different purposes may need different bases
- Necessity means no less intrusive route
- Withdrawal only ends consent based processing
Rapid recall: article numbers
- Article 4
- the definitions section
- Article 5
- the seven principles
- Article 6
- lawful bases for processing
- Article 7
- conditions for valid consent
- Article 8
- children and online services
- Article 9
- special categories of data
- Article 10
- criminal convictions and offenses
- Article 11
- processing not requiring identification
Words the exam uses
- Processing
- almost anything done with data
- Controller
- decides purposes and means
- Recital
- interpretive context, not binding text
- Regulation
- applies directly, no national transposition
- Derogation
- a narrow exception to a rule
Reference strip: principles, bases, consent, special data, scope
Principles
- Seven, with accountability last
- Security is integrity and confidentiality
- Minimization limits what you collect
Bases
- Six under Article 6(1)
- Pick one before you collect
- Public bodies avoid legitimate interests
Consent
- Affirmative action, never silence
- Withdrawal must be equally easy
- Prior processing stays lawful
Special data
- Article 9 prohibits, then permits
- Explicit consent is one condition
- An Article 6 basis still required
Scope
- Establishment, offering, or monitoring
- Anonymous data falls outside
- Pseudonymized data stays inside
Quick exam traps
- Trap: Consent is the strongest lawful basis so it should always be used
- Trap: Pseudonymized data sits outside the scope of the regulation
- Trap: A public authority can rely on legitimate interests for its statutory tasks
- Trap: Explicit consent on its own is enough to process health data
- Trap: The lawful basis can be swapped once the original one fails
- Trap: Recitals are binding legal obligations in their own right
- Trap: Keeping servers outside the Union avoids the regulation
cybercertprep.com · original revision sheet written from the public body of knowledge