Control Strategy GDPRArt.6.1a.ProcessingWithInferredConsent

URI: CSG-GDPR-Art6-1-a-p

Package: GDPR

< prev | next >

Description: Processing of Data by consent of the data subject DataSubject, where they have control over the device SHost providing the data, and so can enforce restrictions consistent with their own consent decisions. It is still necessary to have a consent interface, but policy enforcement is up to the data subject.

Blocked Threats (1)

P.GDPR.HuDPoS-i.6

Lack of legal basis for use of Data related to DataSubject by Process: since the data is related to a person DataSubject who is a citizen or resident in a state where the GDPR applies, a legal basis is required to process the data. Since DataSubject controls the device where the data is stored, this can only be by consent or to protect vital interests if incapacitated.

Triggers Threats (1)

P.GDPR.Hu-aDPoS-i.8

Extra measures are needed for Process to use Data related to DataSubject who may be a child: the legal basis for this data processing under the GDPR is consent, but the subject DataSubject may be a child, so additional measures are necessary for their consent to be valid. If DataSubject cannot be a child, then change them from type Human to type Adult to eliminate this threat.