Re: Fwd: Re: Taxonomy of legal bases

Hi Harsh, hi all,

let me make a brief clarification, plus a compromise suggestion. :)

First the clarification: What Bud and I are aiming at (by repatedly 
nagging you with this topic) is that Art. 6 para (a) can have also two 
different cases namely explicit (yes, it exists there too!) and 
non-explicit consent. In contrast to the case of processing sensitive 
data (Art. 9), both expressions of consent are possible there. This is 
why we need a differentiation of these two possibilities under Art. 6 
para 1 (a).

So my compromise suggestion is now: Instead of acknowledging the two 
different cases by naming them 'explicit' and 'regular' consent, we 
could rather call them 'explicit' and 'non-explicit' consent. Problem 
solved! :)

One additional comment with regard to Art. 22 para 2 (c) and Art. 49 
para. 1 (a) GDPR - these are NOT legal bases on their own! Rather, they 
describe situations where e.g. consent based on Art. 6 para 1 (a) is 
possible, but which trigger the additional condition that it needs to be 
the explicit version of this consent.

Greetings,

Eva



Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein
Eva Schlehahn, uld67@datenschutzzentrum.de
Holstenstraße 98, 24103 Kiel, Tel. +49 431 988-1204, Fax -1223
mail@datenschutzzentrum.de - https://www.datenschutzzentrum.de/

Informationen über die Verarbeitung der personenbezogenen Daten durch
die Landesbeauftragte für Datenschutz und zur verschlüsselten
E-Mail-Kommunikation: https://datenschutzzentrum.de/datenschutzerklaerung/

Am 09.04.2019 um 13:25 schrieb Harshvardhan J. Pandit:
> **Sending to the public mailing list for archival purposes**
>
> To clarify: NO, I'm not saying we create a term called 'regular' consent.
>
> My proposal is to acknowledge in the description (dcterms:description 
> or rdfs:comment) of the term <A6(1)(a)> in our vocabulary that it is 
> the legal basis for what is referred to as "regular" consent in the 
> Guidelines on Consent by A29WP.
>
> The 'definition' of <A6(1)(a)> as a term in our vocabulary is the URI 
> for the text of A6(1)(a) in GDPR (rdfs:isDefinedBy) to indicate its 
> source, with the definition (skos:definition) as -
> "legal basis where the data subject has given consent to the 
> processing of his or her personal data for one or more specific 
> purposes;" --> taking text straight from 6(1)(a).
>
> I think this way we can have our ~'regular' cake~ and eat it too :P
>
>
> On 09/04/2019 12:14, Mark @ OC wrote:
>> Hi Harsh,
>>
>> Are you suggesting we use the word ‘Regular’ in the definition?  Can 
>> we please refrain from using the word regular and go with just 
>> ‘consent’ or ‘explicit consent’ as suggested?
>>
>> The reason being, is that we will have to account for irregular 
>> consent if we use the word regular. This would open another can of 
>> worms.
>>
>> - Mark
>>
>>
>>> On 9 Apr 2019, at 12:08, Harshvardhan J. Pandit <me@harshp.com 
>>> <mailto:me@harshp.com>> wrote:
>>>
>>> Thanks Eva, Bud, Rigo, Mark.
>>>
>>> For our taxonomy/vocabulary, we have a 'flat' list (no-hierarchy) 
>>> for v1, because to create hierarchies we would need further 
>>> discussion on how the other legal basis are related.
>>>
>>> So I propose we go with the following from Eva's email today -
>>>
>>> * A6(1)(a) as the legal basis, and in its description, we mention 
>>> that it requires what is referred to as regular consent by A29WP 
>>> (note - no split into regular and explicit as it is listed currently 
>>> in the spreadsheet)
>>>
>>> * A9(2)(a) as the legal basis, and in its description we mention 
>>> that it requires what is referred to as explicit consent by GDPR and 
>>> A29WP
>>>
>>> * Add additional legal basis that require explicit consent i.e. 
>>> A22(2)(c) and A49(1)(a) to the list as it currently only covers A6 
>>> and A9
>>>
>>> @Eva do you think this is okay to go ahead with?
>>>
>>> - Harsh
>>>
>>>
>>> On 09/04/2019 10:35, Eva Schlehahn wrote:
>>>>
>>>> Dear Harsh, dear all,
>>>>
>>>> after wading through all the back and forth emails touching upon 
>>>> this topic, I am going back to the roots here. In short: I think 
>>>> Bud is right. :)
>>>>
>>>> I discussed at length with Bud in advance and as his preparation 
>>>> for the community group meeting. He is right because we have a need 
>>>> to capture following structure:
>>>>
>>>>   * Consent - as legal basis with the definition: 'A data subject's
>>>>     unambigious/clear affirmative action that signifies an agreement
>>>>     to process their personal data'
>>>>       o Regular consent -> Legal basis of Art. 6 para 1 (a) GDPR
>>>>       o Explicit consent -> Legal basis of Art 9 para. 2 (a) GDPR
>>>>
>>>> Even though Rigo originally saw the term 'regular' critically, I 
>>>> still think it is useful to simply express that there is a 
>>>> difference between the consent required by Art. 6 in contrast to 
>>>> Art. 9. So in principle, we need some term to highlight this 
>>>> difference. And Bud relies on what the former Art. 29 Working Group 
>>>> said since it simply makes no sense to make up something else out 
>>>> of thin air.
>>>>
>>>> Btw. 'freely given & informed' are not definitions, they are 
>>>> conditions. There is a difference. :) And they probably cannot be 
>>>> expressed in a vocabulary since they are always context-dependent 
>>>> and subject to interpretation. :)
>>>>
>>>> Harsh, I like your examples given in your email - and I agree 
>>>> insofar as the explicit consent required a very clear statement 
>>>> from the data subject what they are agreeing to. Please note that 
>>>> this is even a step further than the consent just being 'informed' 
>>>> - in a way, this informed-ness also needs to be expressed explicitly.
>>>>
>>>> Greetings,
>>>>
>>>> Eva
>>>>
>>>> Am 08.04.2019 um 13:39 schrieb Harshvardhan J. Pandit:
>>>>> tldr; This email is regarding using two separate legal basis for 
>>>>> consent as provided by A6(1)(a)
>>>>>
>>>>> Dear Eva, Rigo, and Bud.
>>>>> I'm having trouble understanding the two separate legal basis for 
>>>>> consent as provided by A6(1)(a).
>>>>> This discussion was mostly conducted in the F2F, and because this 
>>>>> is the first time I have come across this interpretation of two 
>>>>> legal basis under A6(1)(a), it would be good to have it in the 
>>>>> mailing list so as to have a point of reference in the future.
>>>>>
>>>>> My understanding of the discussion so far:
>>>>> Please do specify (and if possible, correct) any errors made in 
>>>>> capturing the gist of the discussion.
>>>>> For consent as the legal basis, Eva and Bud suggested 
>>>>> (https://lists.w3.org/Archives/Public/public-dpvcg/2019Apr/0005.html 
>>>>> 1-APR) two types ('regular' and 'explicit') of consent from 
>>>>> Article 6(1)(a), with a reference to A29WP guidelines on consent - 
>>>>> that also mention these two terms.
>>>>> Rigo (skype call in F2F, 4-APR) suggested to remove the word 
>>>>> 'regular' and simply call it consent, and provided the following 
>>>>> definition for (previously regular) consent - "A data subject's 
>>>>> unambigious/clear affirmative action that signifies an agreement 
>>>>> to process their personal data". (personal opinion - I think this 
>>>>> was to provide a definition of 'consent' as a top-level concept in 
>>>>> the taxonomy)
>>>>>
>>>>> Points I'm struggling with -
>>>>>
>>>>> (1) If the (regular) consent is used as a legal basis with the 
>>>>> above definition - would it be valid under the GDPR given that it 
>>>>> does not follow the definition of consent (A4-11) for being 
>>>>> "freely given, informed".
>>>>>
>>>>> (2) Where do we use the GDPR definition of consent (A4-11) in the 
>>>>> taxonomy for legal basis of A6(1)(a) - 'regular' or 'explicit'?
>>>>>
>>>>> (3) In the guidelines for consent by A29WP (Sec.4, pg.18), 
>>>>> 'regular' consent is mentioned in context - The GDPR prescribes 
>>>>> that a “statement or clear affirmative action” is a prerequisite 
>>>>> for ‘regular’ consent.
>>>>> In the same section, 'explicit' consent is mentioned as - "The 
>>>>> term explicit refers to the way consent is expressed by the data 
>>>>> subject. It means that the data subject must give an express 
>>>>> statement of consent."
>>>>> Given that I have no legal background, I'm confused as to wouldn't 
>>>>> every 'regular' consent required by GDPR also be 'explicit' given 
>>>>> the requirement for every consent to be informed, specific, 
>>>>> unambiguous indication by a statement or action (A4-11) - which 
>>>>> covers descriptions of both terms by A29WP?
>>>>> Or, is the difference as follows:
>>>>> - regular - saying "I Agree"
>>>>> - explicit - saying "I Agree to XYZ" ← note explicit mention of 
>>>>> what I'm agreeing to?
>>>>> But wouldn't this be covered by the information in the description 
>>>>> of what they are agreeing to because consent should be informed?. 
>>>>> It does come to my mind, that the 'explicit' in this case may 
>>>>> refer to the requirement of stating that some information, such as 
>>>>> special categories of data, need to be mentioned in an 'explicit' 
>>>>> form in the 'informed' part of consent - in which case, does it 
>>>>> qualify as a separate legal basis OR as the requirements for valid 
>>>>> consent (and therefore not part of legal basis taxonomy)?
>>>>>
>>>>> (4) If conditions provided by A9(2)(a) count as a legal basis 
>>>>> based on 'explicit' consent for special categories of personal 
>>>>> data, do the following also count as a legal basis given that they 
>>>>> are based on 'explicit' consent and are types of processing?
>>>>> - R72 Profiling
>>>>> - A22(2)(c) Automated individual decision-making, including profiling
>>>>> - A49(1)(a) transfers of personal data to a third country or an 
>>>>> international organisation
>>>>>
>>>>> I don't mean to start a long discussion that may delay the work on 
>>>>> wrapping up the taxonomy, so am willing to accept short answers 
>>>>> (e.g. yes/no, use 'this' as definition); but at the same time it 
>>>>> would be very helpful to clarify this things - both for the group 
>>>>> as well as (personally) for my PhD work.
>>>>>
>>>>> Best,
>>>>> Harsh
>>>>>
>>>>> On 01/04/2019 14:36, Eva Schlehahn wrote:
>>>>>>
>>>>>> Dear all,
>>>>>>
>>>>>> Bud and I developed further the taxonomy of legal bases according 
>>>>>> to the GDPR. Please find attached
>>>>>>
>>>>>>   * in the Word document file Bud's version of such a vocabulary, as
>>>>>>     well as
>>>>>>   * in the image file my extension of the already existing
>>>>>>     visualization from lawyer perspective. ;-)
>>>>>>
>>>>>> A pity I cannot make it to Vienna. I wish you all a fruitful 
>>>>>> meeting there. :-)
>>>>>>
>>>>>> Greetings,
>>>>>>
>>>>>> Eva
>>>>>>
>>>>>> -- 
>>>>>> Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein
>>>>>> Eva Schlehahn,uld67@datenschutzzentrum.de
>>>>>> Holstenstraße 98, 24103 Kiel, Tel. +49 431 988-1204, Fax -1223
>>>>>> mail@datenschutzzentrum.de -https://www.datenschutzzentrum.de/
>>>>>>
>>>>>> Informationen über die Verarbeitung der personenbezogenen Daten 
>>>>>> durch
>>>>>> die Landesbeauftragte für Datenschutz und zur verschlüsselten
>>>>>> E-Mail-Kommunikation:https://datenschutzzentrum.de/datenschutzerklaerung/ 
>>>>>>
>>>>>
>>> -- 
>>> ---
>>> Harshvardhan Pandit
>>> PhD Researcher
>>> ADAPT Centre
>>> Trinity College Dublin
>>
>

Received on Tuesday, 9 April 2019 11:52:23 UTC