gdpr privacy data-protection
Under GDPR&#39;s strict consent requirement rules, could a criminal/hacker/troll remain anonymous in all his activities?
<p>Since GDPR strictly requires consent to Personal Identifiable Information (PII), could a criminal exploit online services by remaining anonymous in all his criminal activities?</p>
<p>Providers are not allowed to keep PII without consent. Therefore, any online crimes cannot be traced to the offender.</p>
<p>I have also learnt that online services cannot deny service if a person refuses to consent to the provider's data collection policy as of <a href="https://gdpr-info.eu/art-7-gdpr/" rel="nofollow noreferrer">Article 7 of GDPR</a>. This is also discussed in <a href="https://law.stackexchange.com/questions/73168/does-the-law-give-provisions-for-well-known-service-providers-to-deny-service-if?noredirect=1#comment153216_73168">this question</a></p>
<p>Wouldn't this create a haven for online criminals/hackers?</p>

<p>It is absolutely not the case that</p>
<blockquote>
<p>Providers are not allowed to keep PII without consent.</p>
</blockquote>
<p><a href="https://gdpr-info.eu/art-6-gdpr/" rel="noreferrer">Article 6</a> of the GDPR identifies six possible lawful bases for processing personal information. These are:</p>
<blockquote>
<p>(a) the data subject has given consent ...<br />
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;<br />
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;<br />
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;<br />
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;<br />
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</p>
</blockquote>
<blockquote>
<p>Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.</p>
</blockquote>
<p>If a person requests services from an online service provider, basis (b) will apply, at least to some information. If there is evidence of criminal activity, basis (c) may well apply, as it also will for much routine record keeping. Any in many such cases, basis (e) or (f) will also apply.</p>
<p>In short, article 6 does not create a &quot;haven for online criminals/hackers&quot;.</p>
<p>In a comment on another answer the OP writes:</p>
<blockquote>
<p>The offender has the right to not be identifiable and he can't be denied this right</p>
</blockquote>
<p>That is simply not correct. Nothing in the GDPR says anything of the sort. It is true that consent may not be forced, but if a user requests a service that service <strong>may</strong> require the user to identify him- or herself. For example, one cannot order physical goods without giving a name and a shipping address.  And the provider may retain PI and even PII when it has a &quot;legitimate interest&quot; in doing so, although if challenged it must justify that legitimate interest.</p>

<p>Consent is only one of the 6 GDPR grounds. Necessity is another. Since a provider provides an on-going service, it needs a contract, and the contract by necessity needs to name the parties of the contract.</p>
