gdpr data-protection
Is an auto-submitting form GDPR/DPA-compliant?
<p><strong>TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant?</strong></p>

<p>An organisation I am part of has an online form on their intranet for reporting incidents and near misses.</p>

<p>The other day I was going to use this form to submit a tech. incident report. I opened up the form, but then realised it was not the correct place to submit the report and closed the window.</p>

<p>Later that day I received an automated email with a reference number for the report thanking me for ‘sending it in’ and nothing that ‘the form was only partially completed.’</p>

<p>I raised this with somebody, who raised it to the national HQ. They forwarded me the reply they received, where the NHQ confirmed that the behaviour was intentional and was ‘a failsafe as such in case of a loss of network connection’.</p>

<p>I have never seen this used elsewhere—it almost seems like a well-intentioned use of the <a href="https://www.darkpatterns.org/types-of-dark-pattern/privacy-zuckering" rel="nofollow noreferrer">privacy zuckering</a> dark pattern. There was no indication prior to accesing the form, or on the form itself, that it would autosubmit after interaction regardless of whether the 'Submit' button was clicked or not.</p>

<p>Is this legal under the GDPR/Data Protection Act 2018 (as it is a UK organisation)?</p>

<p>Recital 32 of the preamble to the GDPR states that:</p>

<blockquote>
  <p>Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.</p>
</blockquote>

<p>..which seems to pretty clearly exclude an automatic submission.</p>

<p>That said, perhaps there is an Art. 6, para. 1(c) or (d) exemption at play here, as workplace incident reporting is a statuatory duty under the Health and Safety at Work etc Act 1974.</p>

<p>Because this is a requirement of the HSWA, the lawful basis is not consent, but rather GDPR Art. 6(1)(c):</p>

<blockquote>
  <p>processing is necessary for compliance with a legal obligation to which the controller is subject</p>
</blockquote>

<p>It is also important to identify whether any <em>personal data</em> are indeed being collected and transmitted with this form, as it is this that establishes whether the activity falls within the scope of the GDPR.</p>

<p>In answer to your question, that the form automatically submits the user's input does not make the form either compliant or non-compliant. Depending on what data is being collected, there may be a need to conduct an impact assessment, inform the supervisory authority, or indeed seek (or have sought) consent. So an auto-submitting form is not <em>automatically</em> noncompliant with the GDPR (or UK Data Protection Act 2018).</p>

<h2>Why would consent be the legal basis for collecting personal data here?</h2>

<p>It’s a work health and safety incident report. As such, this falls under a legitimate business reason for collection - consent is not required.</p>
