Certain Legitimate Uses

In one line

Section 7 lists nine uses for which a Data Fiduciary may process personal data without consent, four of them for the State, and clause (i) covers employment including the protection of trade secrets.

The structure

"A Data Fiduciary may process personal data of a Data Principal for any of following uses, namely:" and then nine clauses, (a) to (i).

Nine, not seven. Count them.

Note three things about the architecture.

No notice is required. Section 5(1) is triggered only by a consent request, chapter 1230.

No withdrawal is possible. Section 6(4) applies where consent is the basis. There is nothing to withdraw here.

But every other obligation still applies. The section 8 obligations, the section 11 to 14 rights, security, breach reporting and erasure all bite regardless of which gateway was used.

Clause (a): voluntarily provided data

"For the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data."

Two conditions. The data must have been voluntarily provided by the Data Principal herself, and she must not have indicated that she does not consent.

This is a deemed-consent provision under another name, and it is the most commercially important clause in the section. It covers the ordinary case where a person hands over her details to get something done.

Illustration (I). X makes a purchase at Y, a pharmacy. She voluntarily provides Y her personal data and requests Y to acknowledge receipt of the payment by sending a message to her mobile phone. Y may process the personal data of X for the purpose of sending the receipt.

Illustration (II). X electronically messages Y, a real estate broker, asking Y to find her rented accommodation and shares her personal data for this purpose. Y may process it to identify and intimate details of accommodation available on rent. Subsequently X informs Y that she no longer needs help. Y shall cease to process the personal data of X.

Illustration (II) shows the opt-out working. The clause ends when the Data Principal indicates that she does not consent. So clause (a) is not permanent.

And note the limit: the use is confined to "the specified purpose for which" the data was provided. The pharmacy may send the receipt; it may not add her to a marketing list.

Clause (b): State subsidies and benefits

For the State and any of its instrumentalities to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed, where