If you rely on consent, the person has to know that they can say no without any detriment and change their minds at any time. This is not as a consequence of GDPR, it's how consent works generally. I don't know why legitimate interests (or even necessary for the performance of a contract) doesn't apply, but choosing consent is quite clear. The person has a complete veto over the process throughout its progress if you choose consent as the processing condition.

Best wishes

Tim Turner
www.2040training.co.uk

On Mon, Oct 30, 2017 at 10:58 AM, Gater, Mike (SL) <[log in to unmask]> wrote:

Good Morning all,

 

We are about to carry out a career review of our top tier management, whereby we expect them to complete a detailed career history and invite them to reflect on their accomplishments as well as consider any areas for development and broader career aspirations. The analysis of the data will be carried out be a third party (under a short term contract – completed by Feb 2018). The third party organisation has the toolset and expertise to analyse the data and provide specific reports, whereas we are just not able to do so.

 

“The specific purpose is to gather detailed broad and consistent data on our Band 2/PCH (personal Contract Holder) team in order to align them to the new leadership structure, prepare individual development plans and support future career development”

 

 

I may be overthinking this but when considering the condition for processing, I was originally looking at Sch 2(6)(1) – Necessary for the purposes of legitimate interest. However, it has been challenged that we would have to use “Consent”.

 

I am looking for a consensus of opinion whether any other condition other than Consent could be used?   

 

 

Kind Regards

Mike

 


"The information contained in this email may be commercially sensitive and/or legally privileged. It is intended solely for the person(s) to whom it is addressed. If you are not a named recipient, you are on notice of its status. Please notify the sender immediately by reply e-mail and then delete this message from your system. You must not disclose it to any other person, copy or distribute it or use it for any purpose. 

Views expressed in this email are not necessarily those of Sellafield Ltd.

Sellafield Ltd, a Nuclear Decommissioning  Authority company, is registered in England and Wales, Company number 01002607.  The registered office is situated at Hinton House, Birchwood Park Avenue, Risley, Warrington, Cheshire, WA3 6GR."

All archives of messages are stored permanently and are available to the world wide web community at large at http://www.jiscmail.ac.uk/lists/data-protection.html

Selected commands (the command has been filled in below in the body of the email if you are receiving emails in HTML format):

All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html and are sent in the body of an otherwise blank email to [log in to unmask]

Any queries about sending or receiving messages please send to the list owner data-protection-request@JISCMail.ac.uk

(Please send all commands to [log in to unmask] not the list or the moderators, and all requests for technical help to [log in to unmask], the general office helpline)

All archives of messages are stored permanently and are available to the world wide web community at large at http://www.jiscmail.ac.uk/lists/data-protection.html

Selected commands (the command has been filled in below in the body of the email if you are receiving emails in HTML format):

All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html and are sent in the body of an otherwise blank email to [log in to unmask]

Any queries about sending or receiving messages please send to the list owner [log in to unmask]

(Please send all commands to [log in to unmask] not the list or the moderators, and all requests for technical help to [log in to unmask], the general office helpline)