Hi Andrew

Thanks for that link - that is very useful.

So basically do not rely on consent under GDPR as lawful reason for processing special category data, then you will not have to facilitate withdrawal at any time. You will need consent for other reasons but need to be clear that after consent given, for GDPR purposes the lawful reason you are processing the data is public interest (? Or could there be another, not sure). You can still give a date or time period for option to  withdraw that would operationally be a time before which it would be difficult, impossible, detrimental or too time consuming to do, which I think is a good idea to do anyway.

On first reading that seems to be the conclusion.  Seems to me we need some pretty good generic wording on the consent form to reflect this. Will keep looking on ICO webpages.

Cheers

Judith

Judith Carr | Research Data Manager | | Libraries, Museums and Galleries | PO Box 123 | Liverpool |  L69 3DA | email:  [log in to unmask] |T 0151 795 8528| www.liverpool.ac.uk/rdm|@livUniRDM

-----Original Message-----
From: Research Data Management discussion list <[log in to unmask]> On Behalf Of Andrew Cormack
Sent: 11 July 2018 20:31
To: [log in to unmask]
Subject: Re: GDPR - Lawful basis for processing data in the public interest and ethical consent

Quick reference from my travels. The ICO's latest consent guidance is clear that GDPR consent and Research ethics consent are "entirely separate requirement[s]". See https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/consent/what-is-valid-consent/

HTH
Andrew

-----Original Message-----
From: Research Data Management discussion list <[log in to unmask]> On Behalf Of Catharine Bailey
Sent: 11 July 2018 11:19
To: [log in to unmask]
Subject: GDPR - Lawful basis for processing data in the public interest and ethical consent

Hello all!

A GDPR question!

I'm in the process of making some recommendations to update the University's current consent and PIS templates

I'd appreciate clarification on, what appears to me, to be a situation where subjects rights are contrary in the instance where an Institution's lawful basis for processing personal data is ‘task in the public interest‘ (GDPR Article 6(1)(e)) which would mean the right to erasure does not apply but yet, where ethical consent needs to be be obtained, subjects are told they have the right to withdraw at any time (which would/could be construed as right to erasure).

I may well have misunderstood but if anyone could clarify the situation, I'd be most grateful!

Many thanks,

Catharine Bailey
Research Data Manager
Brunel University London

 

########################################################################

To unsubscribe from the RESEARCH-DATAMAN list, click the following link:
https://www.jiscmail.ac.uk/cgi-bin/webadmin?SUBED1=RESEARCH-DATAMAN&A=1


########################################################################

To unsubscribe from the RESEARCH-DATAMAN list, click the following link:
https://www.jiscmail.ac.uk/cgi-bin/webadmin?SUBED1=RESEARCH-DATAMAN&A=1

########################################################################

To unsubscribe from the RESEARCH-DATAMAN list, click the following link:
https://www.jiscmail.ac.uk/cgi-bin/webadmin?SUBED1=RESEARCH-DATAMAN&A=1