◇ OpenCyber Academy
Professional · Chapter 7 · English

Chapter 7 — Consent and lawful basis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Consent and lawful basis

Lesson map

Lesson 07 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Why consent records matter"]
  N2["Lab — Marketing consent records for 4,000 synthetic"]
  N3["7.2 Results"]
  N4["7.3 Lawful bases"]
  N5["7.4 Fixing weak records"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Why consent records matter"]
  N2["Lab — Marketing consent records for 4,000 synthetic"]
  N3["7.2 Results"]
  N4["7.3 Lawful bases"]
  N5["7.4 Fixing weak records"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX031"]

[Learning outcomes]
    |
    v
[7.1 Why consent records matter]
    |
    v
[Lab — Marketing consent records for 4,000 synthetic]
    |
    v
[7.2 Results]
    |
    v
[7.3 Lawful bases]
    |
    v
[7.4 Fixing weak records]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) check whether consent records support marketing; (2) choose lawful bases for different uses; (3) fix weak consent records.

7.1 Why consent records matter

Northbank emails donors about appeals and events. Electronic marketing rules require consent for such emails, and the GDPR requires that the charity can show consent was given. Grace checks the donor database's consent field. Some records say yes with a date and source, some say yes without a date, some say no and some are blank. She explains that a yes without a date cannot show when or how consent was given, which makes it weak evidence if a donor complains. Grace counts each kind.

Lab — Marketing consent records for 4,000 synthetic donors

"""Check marketing consent records for 4,000 synthetic donors (stdlib only)."""
import random
random.seed(8)
rows = []
for _ in range(4000):
    r = random.random()
    rows.append("yes_dated" if r < 0.62 else "yes_undated" if r < 0.77 else "no" if r < 0.93 else "blank")
for k in ["yes_dated", "yes_undated", "no", "blank"]:
    n = rows.count(k); print(f"{k:<12} {n:5d} ({100*n/len(rows):.1f}%)")
print(f"safe to email: {rows.count('yes_dated')} of {len(rows)}")

Run with python3 lab_consent.py. Verified output:

yes_dated     2507 (62.7%)
yes_undated    595 (14.9%)
no             615 (15.4%)
blank          283 (7.1%)
safe to email: 2507 of 4000

7.2 Results

The lab checks four thousand synthetic donor records. Records with a dated yes number 2,507, 62.7 percent. Undated yes records number 595, 14.9 percent. Records marked no number 615, 15.4 percent, and 283 are blank, 7.1 percent. Grace concludes that only the 2,507 donors with dated consent should receive marketing emails until the others are checked. The fundraising manager is surprised, having assumed that every yes was usable. Grace explains that the undated and blank records may well belong to supporters who are happy to hear from Northbank, but the charity cannot show it, so the safest choice is to ask them again rather than assume.

7.3 Lawful bases

Grace reviews lawful bases with Mr. Nowak. Marketing emails rely on consent. Processing donations and sending receipts rely on the charity's contract with the donor or legal obligations for tax relief. Client referrals rely on legitimate interests or public task considerations, plus a condition for special category data, which the external data protection officer helps confirm. She records each basis in the inventory so staff know which rules apply. The external officer reviews the list and confirms each basis, adding a short note on the condition used for health details in referrals.

7.4 Fixing weak records

For the 595 undated yes records, Grace and the fundraising manager plan a short preference form enclosed with printed gift receipts, so that donors can confirm their choices without Northbank sending marketing emails it cannot yet justify. Donors who confirm are recorded with the date and method. Blank records are treated as no. New sign-up forms record consent with date, wording shown and source automatically. Mr. Nowak notes that good records protect the charity and respect donors' choices. The fundraising manager agrees readily.

Worked example

Grace finds 2,507 of 4,000 donors (62.7 percent) with dated consent, 595 undated, 615 no and 283 blank, limits emails to dated consent, records lawful bases for each use and plans reconfirmation through receipts.

Synthetic case. Donors are synthetic; outputs come from lab_consent.py; the GDPR is real. This is not legal advice.

Errors and limits

Treating any yes as valid consent ignores the need to show when and how it was given.

Exercises

Continue studying — lesson 07 (chapter 07 of 12)

← Chapter 06 · Course chapter index · Chapter 08 →

Continue to the next authored lesson.