Refusal to have personal data processed for purposes unrelated to the contractual relationship

The existence of a contract does not authorise per se the use of the other party’s personal data for any purpose. On the contrary, the other party’s prior consent and the possibility that, at the same time, it may oppose the processing of data are required. 

It is not uncommon that the personal data resulting from a contractual relationship are used for purposes other than those intended in the contract without data subjects knowing precisely the purposes for which such data will be used. It is obvious that the data obtained from a contract are processed to maintain, control and develop the contractual relationship. However, what data subjects do not know, and may also be unlawful if the principle of consent is not observed, is that such data may be used for other purposes, such as sending advertising information, or transferring it to the group companies so that they can, for example, send commercial communications.

The Regulations implementing the Spanish Data Protection Law (Ley Orgánica de Protección de Datos de Carácter Personal) expressly establishes that data subjects can oppose having their personal data processed for purposes other than those directly related to the maintenance, control and development of the contractual relationship. In order for data subjects to express their refusal, the legislator considers that a clearly visible unchecked checkbox shall be included in the contract document. The legislator also allows data controllers to use equivalent procedures to the one herein described. This is of particular importance when the contract is entered into by non-traditional means (i.e. a contract accepted by telephone).

It is precisely the use of the equivalent procedure mentioned above what has impelled the Spanish Data Protection Agency to make several pronouncements on this issue. However, as it can be deduced from the provisions of the Regulations implementing the Spanish Data Protection Law, it is clear that the procedure by which data subjects can oppose having their personal data processed for purposes other than the ones stated in the contract should prove to be as effective as the proposed method of including a clearly visible and unchecked checkbox in the contract document itself.

In this connection, the Spanish Data Protection Agency has ruled out as valid opposition procedures those that do not allow data subjects to express their refusal at the same time that their consent is requested. As an example, it would not be acceptable to provide a refusal form that is not an integral part of the consent document itself or to include an email address to express such refusal in the contracting process because both options exclude the possibility that the request for the consent and the refusal to have the personal data processed may be given at the same time.

The foregoing is only an example of the data subject’s faculty to dispose and control its personal data as recognized under the data protection legislation. In fact, in order for the data subject’s consent to be validly given, the data subject shall be expressly, accurately and unequivocally informed in advance. Data subjects shall be informed, amongst other things, of who is going to process their data, the data processing purposes unrelated to the contractual relationship and how they can express their refusal to have their data processed at the same time their consent is requested.

In conclusion, it seems advisable to warn companies that the contract documents they use, whether they are in paper or electronic form, should include an unchecked checkbox so that their clients may express their refusal to have their personal data processed for purposes unrelated to the contract they are going to sign. If the contract is accepted by telephone, companies should use a mechanism equivalent to the one described above and, therefore, it would also be advisable to have the conversation recorded.