A company has collected personal data tor direct marketing purpose on the basis of consent. It is now considering using this data to develop new products through analytics. What is the company first…

Question

Options

• AObtain specific consent for the new processing
• BOnly inform the data subjects of the new purpose.
• CProceed no further, as such repurposing is unlawful
• DUpdate the privacy notice upon which consent was given

• A
  78% (14)
• B
  11% (2)
• C
  6% (1)
• D
  6% (1)

Explanation

According to the GDPR, consent is one of the lawful bases for processing personal data. Consent means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Therefore, consent must be specific to each purpose of processing and cannot be bundled with other purposes. If a company wants to use personal data for a new purpose that is not compatible with the original purpose for which consent was given, it must obtain a new consent from the data subjects for the new processing. Simply informing the data subjects of the new purpose or updating the privacy notice is not sufficient, as it does not imply the data subject's agreement to the new processing. Proceeding with the new processing without obtaining a new consent would be unlawful and could result in fines and sanctions.

No community discussion yet for this question.