Thread by @EUstaran

Steadily approaching #GDPR anniversary and I see two big & fundamental issues everyone is really struggling with:
1️⃣Lawful grounds for processing
2️⃣DPIAs
One is as old as #EUdataP law itself but the #GDPR has injected new impetus. The other is yet to be learnt properly. Thread⬇️

There are three grounds for processing that get 99% of the attention:
1️⃣Consent seems easy & solid, but it is the most difficult.
2️⃣Contractual necessity is yet to be explored & debated properly.
3️⃣Legitimate interest is seen as the holy grail but remains largely misunderstood.

The standards for valid consent will eventually be settled by #CJEU but it is clear that #GDPR raises the bar well above what has become common practice (think cookie banners & ‘take it or leave it’ approaches). So consent is bound to become the residual option, not the default.

The @EU_EDPB guidance on contractual necessity is clear-cut but it shows how narrowly DPAs are thinking about it. This is understandable but a debate about the evolving nature of digital services is needed to get to the bottom of this legal basis.

Legitimate interests risks to be abused as a #GDPR ground for processing, in the same way consent has been abused. So expect very strict views from regulators to compensate.
Much work awaits to prove that this can be relied on but it will be the way forward for most.

Which leads me to the final point: #DPIAs are fundamental among other things to identify the legal basis. But they are tricky and cutting corners is tempting.
My advice: Make an effort to learn how to do DPIAs properly focusing on the law & the resulting compliance actions. END