contract-law privacy gdpr consent
GDPR - Is consent really necessary for contact form?
<p>I am looking for an answer that is supported by the GDPR, so please try to quote GDPR parts as you answer.</p>

<p>The internet is on fire (developers especially) now that the GDPR is on strength. There are some doubts from my perspective which I would like to clear out with the discussions that arise from this questions.</p>

<ol>
<li>Do we need a user's consent when being contacted by a contact form?</li>
</ol>

<p>Many (almost all to be exact) lawyers advise companies to seek consent from the user on the contact form. This sounds ridiculous, as what happens when the user sends you a direct email (without using contact form) with a bunch of his personal data (which you, as a business, did not ask from the user)? How could you know what data the user might send? He might even send the data on purpose and sue your company for not having included in the privacy policy that your business is processing the data that the user has sent. How does this make sense? Isn't the action of voluntarily sending an email to anyone a direct consent (you are aware that you sent the email from your own email address and you yourself have decided to reveal some or all of your personal data to the person/business you are sending an email to)?</p>

<ol start="2">
<li>Managing consent</li>
</ol>

<p>If the answer to the first question is "YES", that how do we manage the consents? Consents must be fully manageable so the user can withdraw it at any time. So, do we store each and every email in a database? Storing it in an Excel table would not be a wise way according to the GDPR, as you literally cannot protect Excel worksheet from being read (yes, for all those around who think that protecting the workbook with a password is enough, no it is not, there are hundreds of tools that will crack the password and open the workbook). And then again, GDPR is not meant to drive the business to its own doom. It is not meant to harden that way that the business does its own core business, but it is meant to protect the data of the subjects.</p>

<hr>

<p>I suppose the information above is enough for a start of good discussion as to whether the user's consent should be asked when filling out a contact form.</p>

<p>My interpretation of the GDPR when it comes to a contact form is as long as your privacy notice states that what data you collect in the contact form and what legal basis that data is used for you are fine.</p>

<p>Someone submitting a contact form in my opinion is their consent to reply back to them regarding the data in which they have submitted.</p>

<p>Another good clause to have in your privacy policy is to basically state if the user submits information about another natural person that they have consent from that natural person for that data and what it would be used for.</p>

<p>The internet is the internet. People have been trolling it for years. People have also submitted false information for years. The best a business can do is simply outline what their site does, what data is collected and what it will be used for. That along with what legal basis it’s processed for and following it makes you GDPR compliant in that regard. As to withdrawing consent and the rights given by the GDPR that’s all specific to what infustructure a business has in place.</p>

<p>As a developer I know the headaches of the GDPR. Most of it resides in the fact data is not centralized and thus can’t easily be retrieved, modified, or removed. Once you’ve tackled that aspect providing the user their rights under GDPR isn’t to far off.</p>

<p>Beware, a lot of GDPR quotes ahead.</p>

<blockquote>
  <p>Do we need a user's consent when being contacted by a contact form?</p>
</blockquote>

<p>No, Article 4(11) states:</p>

<blockquote>
  <p>‘consent’ of the data subject means any freely given, specific, <strong>informed</strong> and unambiguous indication of the data subject's wishes by which he or she, by a statement or by <strong>a clear affirmative action</strong>, signifies agreement to the processing of personal data relating to him or her;</p>
</blockquote>

<p>If the user knows that he is using a contact form then clicking "submit" is a clear affirmative action.</p>

<blockquote>
  <p>the user sends you a direct email (without using contact form) with a bunch of his personal data (which you, as a business, did not ask from the user)</p>
</blockquote>

<p>The user is the original <strong>controller</strong> of its own data. When he sends you data for which you haven't beforehand determined purposes and means of processing, then you're <strong>not</strong> a controller of that data, see Article 4(7):</p>

<blockquote>
  <p>‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, <strong>determines the purposes and means of the processing of personal data</strong>; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;</p>
</blockquote>

<p>You are <strong>not</strong> a <strong>processor</strong> either because you didn't ask about that data, there is no legal agreement between you and the controller, you're not acting legally "in his name". Article 4(8):</p>

<blockquote>
  <p>‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;</p>
</blockquote>

<p>You are a so-called 'third party', Article 4(10):</p>

<blockquote>
  <p>‘third party’ means a natural or legal person, public authority, agency or body <strong>other than</strong> the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;</p>
</blockquote>

<p>Which also makes you a 'recipient', Article 4(9):</p>

<blockquote>
  <p>‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether <strong>a third party</strong> or not. </p>
</blockquote>

<p>Now, as a third party you can process data without the data subject's consent for your legitimate interests. Article 6:</p>

<blockquote>
  <p>Processing shall be lawful only if and to the extent that at least one of the following applies: (...) processing is necessary for the purposes of the <strong>legitimate interests</strong> pursued by the controller or by <strong>a third party</strong>, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</p>
</blockquote>

<p>Which means that you can delete unwanted data (you have a legitimate interest to do not waste your server space with data you are not properly authorized to have) or even call the police (eg. someone sent you child pornography). However, you should inform data subject(s) of all things listed in Article 13 <strong>even if you're not a controller</strong> and describe your "legitimate interest" as there is a special rule in Article 13.1.(d):</p>

<blockquote>
  <p>Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (...) (d) where the processing is based on point (f) of Article 6(1), <strong>the legitimate interests</strong> pursued by the controller <strong>or by a third party</strong>;</p>
</blockquote>

<p>Your next question:</p>

<blockquote>
  <p>If the answer to the first question is "YES", that how do we manage the consents?</p>
</blockquote>

<p>You have to manage them somehow even if the answer is "NO".</p>

<blockquote>
  <p>So, do we store each and every email in a database?</p>
</blockquote>

<p>You email server IS a kind of database already. You should try to do anything in it. It's probably very secure (unless you use weak passwords) and has all search and filter functionalities you need.</p>

<p><strong>UPDATE with some historical perspective:</strong></p>

<p>To further justify my statement, I will recall the predecessor of GDPR, the Directive 95/46/EC which states in Recital 47:</p>

<blockquote>
  <p>(47) Whereas where a message containing personal data is transmitted by means of a telecommunications or electronic mail service, the sole purpose of which is the transmission of such messages, <strong>the controller in respect of the personal data contained in the message will normally be considered to be the person from whom the message originates</strong>, rather than the person offering the transmission services; whereas, nevertheless, those offering such services will normally be considered controllers in respect of the processing of the additional personal data necessary for the operation of the service;</p>
</blockquote>

<p>So once again: if someone sent you some data via e-mail or web form, he/she was considered <strong>the controller</strong>.</p>

<blockquote>
  <p>I am looking for an answer that is supported by the GDPR, so please try to quote GDPR parts as you answer</p>
</blockquote>

<p>I think the GDPR does not directly answer your question. You question is very practical, but laws are theoretical. So it all depends how you interpret and match it.</p>

<p>This Q&amp;A form might be very good, because different people can post their view, others can upvote. The answer with the most upvotes is likely the best answer. I basically do not disagree with <a href="https://law.stackexchange.com/a/29524/18215">Shinrai's answer</a>, but I do have an alternative point of view.</p>

<blockquote>
  <p>Do we need a user's consent when being contacted by a contact form?</p>
</blockquote>

<p>I do not think so, because using a contact form can be considered entering a contract. In that case you do not need consent at all.</p>

<p>A contract consists of <a href="https://en.wikipedia.org/wiki/Offer_and_acceptance" rel="nofollow noreferrer">an offer and acceptance of that offer</a>. With a contact form, You offer a service to answer a question for free. (Or at least try to answer it). I can accept the offer by entering my name, email-address and the question itself, and press the "send" button. At this moment, <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Art. 6(1)(b) GDPR</a> would apply;</p>

<blockquote>
  <ol>
  <li><p>Processing shall be lawful only if and to the extent that at least one of the following applies:</p>
  
  <p>(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;</p></li>
  </ol>
</blockquote>

<p>After entering the contact form (or before), you have to <a href="https://gdpr-info.eu/art-13-gdpr/" rel="nofollow noreferrer">inform</a> about the processing of personal data. This can include things like:</p>

<ul>
<li>We will reply to you by email within X business days.</li>
<li>After we replied, we will keep your data for two more weeks in case you have a follow-up question.</li>
<li>We store the IP-address from which this form was posted to avoid misuse of this form.</li>
</ul>

<p>You will have to delete data because of <a href="https://gdpr-info.eu/art-5-gdpr/" rel="nofollow noreferrer">Art. 5(1)(e) GDPR</a> ("storage limitation"). If you put a unique reference in each email message, it will be easier to delete all messages belonging to the same request.</p>

<blockquote>
  <p>(yes, for all those around who think that protecting the workbook with a password is enough, no it is not, there are hundreds of tools that will crack the password and open the workbook)</p>
</blockquote>

<p>Keep in mind that current "best practices" are fine. So you do not even need to password protect a workbook if you store it on a properly protected network file server. But make sure you use good passwords, and install security updates.
However you do probably have to use <a href="https://en.wikipedia.org/wiki/Transport_Layer_Security" rel="nofollow noreferrer">TLS</a> for your contact form, as an unencrypted internet connection is readably by everyone when using an <a href="https://en.wikipedia.org/wiki/Wireless_access_point#Security" rel="nofollow noreferrer">open access point</a>.</p>

<p>There are 6 &quot;<a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/" rel="nofollow noreferrer">lawful bases</a>&quot; (i.e. plural of &quot;basis&quot;) under which you are permitted to process personal data. Consent is only one. The others are:</p>
<blockquote>
<p>(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.</p>
<p>(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).</p>
<p>(d) Vital interests: the processing is necessary to protect someone’s life.</p>
<p>(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.</p>
<p>(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)</p>
</blockquote>
<p>For a contact form the <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/contract/" rel="nofollow noreferrer">&quot;contract&quot; basis (b)</a> is the most applicable: this is part of the processing you need to carry out in order to get to the point of having a contract. As such you don't need consent. Also consent is not applicable because you are requiring them to provide this information before you will get back to them. Under the GDPR &quot;consent&quot; has to be <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/" rel="nofollow noreferrer">opt-in and not a precondition for service</a>.</p>
<p>Your form should state that you are using this basis because they are asking you to contact them with a view to possibly entering into a contract.</p>
