Quickfold Business Solutions Ltd. (QBS)
Statement of GDPR Data Processing

The standards for lawful consent have now been raised under the GDPR. On 25th May 2018, the new EU regulation (GDPR), aims to give citizens control of their personal data and to simplify the regulatory environment for internal businesses by unifying the regulation within the EU. Personal data must be collected for specified, explicit and legitimate purposes relative to the purposes for which they are processed.

Under the EU General Data Protection Regulation (GDPR) QBS process your data for Legitimate interests.

Legitimate interests: when a private-sector organisation has a genuine and legitimate reason (including commercial benefit) to process personal data without consent, provided it is not outweighed by negative effects to the individual’s rights and freedoms.

What is the “legitimate interests” condition?

New General Data Protection Regulations recognise that we may have legitimate reasons for processing personal data that other conditions for processing do not specifically deal with. The “legitimate interests” condition is intended to permit such processing, provided we meet certain requirements.

The first requirement is that we must need to process the information for the purposes of our legitimate interests or for those of a third party to whom we disclose it. We need to process your information to enable us to fulfil our commercial interest and our business partnership with you. We may also need to engage a third party for other reasons such as finance agreements, legal advice or debt collection. Although you may not have consented to this disclosure, it is made for the purposes of our legitimate interests.

The second requirement, once the first has been established, is that these interests must be balanced against the interests of the individual(s) concerned. The “legitimate interests” condition will not be met if the processing is unwarranted because of its prejudicial effect on the rights and freedoms, or legitimate interests, of the individual. Our legitimate interests do not need to be in harmony with those of the individual for the condition to be met. However, where there is a serious mismatch between competing interests, the individual’s legitimate interests will come first.

Finally, the processing of information under the legitimate interests condition must be fair and lawful and must comply with all the data protection principles. We must ensure your data is accurate, that it is up to date and that it is not excessive.

At least one of the conditions listed above must be met whenever we process personal data.

What conditions need to be met in respect of sensitive personal data?

If the information is sensitive personal data, at least one of several other conditions must also be met before the processing can comply with the first data protection principle. These other conditions are as follows.

• The individual whom the sensitive personal data is about has given explicit consent to the processing.
• The processing is necessary so that we can comply with employment law.
• The processing is necessary to protect the vital interests of:
• the individual (in a case where the individual’s consent cannot be given or reasonably obtained), or
• another person (in a case where the individual’s consent has been unreasonably withheld).
• The processing is carried out by a not-for-profit organisation and does not involve disclosing personal data to a third party, unless the individual consents. Extra limitations apply to this condition.
• The individual has deliberately made the information public.
• The processing is necessary in relation to legal proceedings; for obtaining legal advice; or otherwise for establishing, exercising or defending legal rights.
• The processing is necessary for administering justice, or for exercising statutory or governmental functions.
• The processing is necessary for medical purposes, and is undertaken by a health professional or by someone who is subject to an equivalent duty of confidentiality.
• The processing is necessary for monitoring equality of opportunity, and is carried out with appropriate safeguards for the rights of individuals.

In addition to the above conditions – which are all set out in the Data Protection Act itself – regulations set out several other conditions for processing sensitive personal data. Their effect is to permit the processing of sensitive personal data for a range of other purposes – typically those that are substantially in the public interest, and which must necessarily be carried out without the explicit consent of the individual. Examples of such purposes include preventing or detecting crime and protecting the public against malpractice or maladministration.

A full list of the additional conditions for processing is set out on the legislation.gov website:

When is processing “necessary”?

Many of the conditions for processing depend on the processing being “necessary” for the particular purpose to which the condition relates. This imposes a strict requirement, because the condition will not be met if the organisation can achieve the purpose by some other reasonable means or if the processing is necessary only because the organisation has decided to operate its business in a particular way