Q: My recruitment agency holds a database of candidates which I wish to bring into compliance before May 25th. However, it contains a number of data subjects who I know will not supply consent if requested. This is because of their past misconduct.
Can I process data in any way other than with consent?
A: If you are already processing on the grounds of consent, then probably not. Also, if you attempt to avoid a consent request because you know it will be denied, this is a strong indication that the data should be treates with extra care.
For example: you might instead attempt to process on the grounds of a Legitimate Interest. But that would require a Legitimate Interest Assessment to demonstrate the basis. During this report, you would need to explain the above situation, while balancing the relationship of interests. Doing so would make it virtually impossible to justify the process.
References:
Article 6, GDPR
Recital 39, GDPR
Recital 42, GDPR
Additional Information:
This is only true when processing relies on existing consents. However, if the occurs as part of an ongoing contract between the Data Subject (a candidate) and the Data Controller (the recruiter), it may be feasible to continue processing personal data within the scope of that original agreement.
Equally, if there is a legal obligation to continue processing data subjects’ data, the data controller must continue processing.