IEEE Technology and Society Magazine - December 2020 - 66

The GDPR has imposed strict new
rules concerning what constitutes
informed consent from a data subject
to process their personal data.

organization specific, unambiguous consent to process
their data, for example by opting into the email list.

Definition of Consent
The GDPR has imposed strict new rules concerning
what constitutes consent from a data subject to process
their personal data.
The consent must be " freely given, specific,
informed, and unambiguous. " Requests for consent
must be " clearly distinguishable from the other matters " ; they should also be presented in " clear and plain
language. " The data subject is free to withdraw their
previously given consent whenever they want; an organization must honor their decisions. " Data subjects
must be able to withdraw consent as easily as it was
given " [16]. It is not enough for the business to simply
change the legal basis of the processing. Underage
individuals may only give consent with permission of
their parent. Finally, documentary evidence of the
consent must be kept.
It should be recalled that in accordance with Council
Directive 93/13/EEC [18] a declaration of consent preformulated by the controller should be provided in an
intelligible and easily accessible form, using clear and
plain language, and it should not contain unfair terms.
Furthermore, for consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the
personal data are intended. Consent should not be
regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw
consent without detriment (See: point 42 of the preamble to GDP).

Cases When Consent is not Needed
There also exist several cases when the consent is
not needed to process the personal data. Those
cases often reflect the need for homeland security,
networks and systems security, commercial processing and public interest or duties, or public organizations. Such situations and cases are specified in
Article 6 of the GDPR. The cases when consent is not
needed are:

1) Processing of the data is necessary to prepare to or
execute a contract to which the data subject is a
party (e.g., doing a background check).
2) The data must be processed in order to comply with
a legal obligation, e.g., when the organization receives
an order from the court in their jurisdiction.
3) It is necessary to process the data in order to save a
person's life.
4) Processing is needed to perform a task in the public
interest or in order to carry out some official functions.
5) The organization has a legitimate interest to process
a person's personal data. Although this may be the
most flexible lawful basis, the " fundamental rights
and freedom of the data subject " will always override
the interest of an organization. This is especially true
for the data of children.
Of course, there exist specific requirements for situations where the above exceptions are used and implemented, such as: the basis must be documented, and
the data subject should be notified. If the organization
later decides to change their justification, a good reason
is needed. The new reason must then be documented,
and the data subject must be notified again.
Moreover, GDPR features several articles of the Preamble when situations and cases, as well as legal background for processing personal data without the data
subject consent (very often in cases of network security), are mentioned. See for example Points 40, 44, 45,
46, 47, and 49 of the Preamble.
From the perspective of network security, malware,
and stegomalware detection, Point 49 of the Preamble is
quite important. It reads: " The processing of personal
data to the extent strictly necessary and proportionate
for the purposes of ensuring network and information
security, i.e. the ability of a network or an information
system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and
confidentiality of stored or transmitted personal data,
and the security of the related services offered by, or
accessible via, those networks and systems, by public
authorities, by computer emergency response teams
(CERTs), computer security incident response teams
(CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of
the data controller concerned. "
Moreover, as pointed out in Points 52 and 68 of the
Preamble, data subject consent is not always needed
even for processing of sensitive data, and certain
specific derogations are mentioned in those Points of
the Preamble.

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

∕

DECEMBER 2020

IEEE Technology and Society Magazine - December 2020

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2020