Recital 43
General Data Protection Regulation · UE 2016/679
| (43) | In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. |
In Luxembourg, the CNPD applies Recital 43 with particular rigour in the public and para-public sector (municipalities, hospitals, the University, CNS, ADEM) where the imbalance is treated as virtually irrebuttable as soon as a public service is at stake. The law of 1 August 2018 on the organisation of the CNPD grants the authority an immediate injunction power to suspend a flawed consent collection, even before any financial sanction.
Luxgap practice: for any processing involving a Luxembourg public authority or an employer, never rely on consent by default. Prefer public interest mission (Article 6(1)(e)) or legal obligation (Article 6(1)(c)) and document that choice in your register.
