Since the introduction of GDPR, for the data processing to be lawful, it must be consistent with all applicable laws in the particular circumstances. Under the GDPR you must have a legal basis to collect the data and to the extent one of the following legal grounds is met:
Consent
We are allowed to use your personal data if we have your consent or another legally permitted reason applies. Article 6(1) a GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. The consent must meet the following conditions:
• Freely given
Not if service is conditional on consent
Not if there is a clear imbalance of power between the data subject and the controller
As easy to withdraw as it is to give
• Specific
For all purposes
• Informed
Clearly distinguishable from other matters
Intelligible
Clear and in plain language
• Unambiguous indication of wishes
Absolutely clear
Performance of a Contract
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at request of the data subject prior to entering into a contract. For example, when you have purchased a product in a webstore. To be able to send the items to you, the webstore has to process your personal data as in delivery address and make it available to the postal service in order to make sure the goods get delivered.
Legal Obligation
Processing is necessary for compliance with a legal obligation to which the controller is subject.
For example tax or social security obligations.
Vital Interest
Processing is necessary to protect the vital interests of the data subject or another natural person. For instance, personal data needs to be processed to save someone’s life. This criterion will be relevant only in rare emergency situations.
Public Interest
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. For example storing information about driver license.
Legitimate Interest
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third-party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
There are three elements to the legitimate interests basis. Before you use this legal basis, you need to:
• identify a legitimate interest; They can be your own (commercial) interests or the interests of third parties.
• show that the processing is necessary to achieve it; and
• the legitimate interest cannot be overridden it against the individual’s interests, rights and freedoms.
You have given specific and explicit permission to process your personal data for a specific purpose. In this case, you can withdraw your consent at any time by sending an email to:
dataprivacyofficer@n-sea.com