gdpr
Can I process personal data without consent if it it helps me serve the user sooner, rather than later?
<p>I am designing an application and would like to process personal data in a way that may not be strictly necessary to fulfill a customer's request, but that would facilitate my doing so.</p>
<p>It'd be a bit like going to Amazon to order something Amazon doesn't currently sell, and then Amazon tracking the search so that it knows how many people want that item, to help Amazon decide which products to add to its inventory.</p>
<p>Do I need request to process personal data in this way?</p>

<p>Yes, you can likely use data in this way without consent, especially if you're just gathering aggregate statistics and are not performing invasive tracking of customers.</p>
<p>In a GDPR context, consent is only a last resort if no other legal basis applies. Common alternative legal bases include:</p>
<ul>
<li>Art 6(1)(b) necessity for performing a contract to which the data subject is party</li>
<li>Art 6(1)(f) necessity for a legitimate interest</li>
</ul>
<p>In your example, the online shop might have a legitimate interest in analytics, gauging interest in products, and managing inventory efficiently.</p>
<p>A legitimate interest requires that you conduct a balancing test: does the legitimate interest outweigh the data subject's rights, interests, and freedoms? This also depends on the existing relationship between controller and data subject – can the data subject reasonably expect their data to be used in this way?</p>
<p>In this scenario (inventory management), only very little personal data is being processed: the interesting data is probably not <em>which customers</em> indicated interest in a product, but <em>how many customers</em> indicated interest. Aggregate statistics might not even be personal data, though calculating the statistic does involve processing of personal data and thus needs a legal basis. On the other hand, if this processing activity requires the creation of per-customer profiles (e.g. estimating how likely they are actually going to buy the product, based on their individual history) then it would be more difficult to argue that a legitimate interest outweighs the data subject's rights.</p>
<p>When using data that was collected for one purpose and reusing the data for another purpose, you'll also have to perform a compatibility test per Art 6(4) GDPR. Similar to the legitimate interest balancing test this is very contextual. However, additional safeguards such as pseudonymization weigh in favour of compatibility. Art 5(1)(b) also mentions that processing for statistical purposes will always be considered compatible, but doesn't define “statistical purposes” any further.</p>
