On 21 August 2020, the Polish DPA, Urzad Ochrony Danych Osobowych (“UODO“), published on its website a statement on the consent as a legal basis under the GDPR.
UODO clearly states that controllers may rely on consent as a processing ground only in cases where no other legal basis provided under Article 6 of the GDPR would legitimize the respective processing. Among other aspects, UODO mentions that relying on consent in any other circumstances may violate the principle of transparency and fairness referred to in Article 5 of the GDPR since the data subjects would have the impression that by withdrawing it, the controller will cease the processing.
UODO’s statement is available here (only in Polish).
