The Lawful Basis Minefield: Why Getting It Wrong Undermines Everything

that's a good question um i think before we really dive into that i think what we need to establish is what is lawful basis because i talk to clients regularly and they're not actually sure what i'm saying to them what we actually mean by lawful basis is the legal reason to do something So when we're processing data, we need to have a legal reason to do it.

And if there's no legal reason for us to be processing that data, then we shouldn't be doing it.

So it's important because fundamentally it makes up the framework of privacy.

So it's one of the six lawful basis, six legal reasons to process something.

And we should be able to in every walk of life, every part of business when we're processing data, we should be able to tie that back to one of those legal reasons to process the data.

So I think that's really important because I get that quite a bit.

What does lawful basis mean? You know, what does that mean to me? It means that you have to make one of these apply to enable you to do something.

Let's look at some practical examples.

You know, consent, for example.

Everybody understands what the word consent means, but it's much more than you think it is.

It's much deeper than you think it is.

Consent can mean a number of different things.

It's a permission, effectively, when it comes to processing data.

It's someone giving you their permission to do something with their information, a consent.

So if you think about in the workplace, for example, you know, where you may give consent to your employer to enable them to use images of you on their Facebook, for example, or on their socials to promote the business or to LinkedIn and places like that, as opposed to when your employer needs to perhaps process your photograph, maybe for your security line yard to get in and out of the building.

Well, that would be a contractual lawful basis because you would need that from a security perspective.

It's part of your employment contract.

It's part of the terms that you would need to have a security pass.

So that just shows you how processing data in the same organisation about the same person and potentially the same piece of data, but for completely different reasons.

So different legal basis, different lawful reasons to do something.

So that's just a bit of an example to try and get you thinking about all the different choices you've got and how you make them fit and why that's important, because I think that's where we come back to.

Well, actually, why does any of this matter? Why is this important? as part i mean this is not a new thing either this is not just a gdpr thing this is pre this is you know the old data protection act 1998 the lawful basis were there they were worded a little bit different but ultimately they were the same you know they were pretty much the same although there were seven not six back then So, yeah, a little bit different.

But ultimately, we have to identify when we start doing something, when we when we decide to get this idea to do something, we're going to maybe run a new project or we're going to look at maybe processing more data about our staff or our customers or our clients for a reason.

We've got an idea to do something.

So when we do that, we have to identify the very beginning of that process, a lawful reason to do it, a legal basis.