Consulting data subjects to obtain their views on the processing empower them to exert control on the process during the design stage. When data subjects are asked for their consent, they would only have two choices, accept or reject. But by considering their views, data subjects can have additional control on the processing, beyond accepting or rejecting. This is especially important when using legitimate interest as the lawful basis of processing. Ensuring that data subject’s views – their feedback and opinions – have been incorporated during project design can increase transparency, and therefore trust in the process, which can in turn result in a larger proportion of individuals positively granting their consent – or reducing the number of opt-outs/objections when using legitimate interest.

The nature of the processing determines whether a consultation is appropriate or not. Generally accepted processing activities, like ordering a pizza, organizing a congress or managing a survey, largely conform to the reasonable expectations of data subjects, and seeking data subject’s views is unlikely to bring additional improvements on data protection. On the other hand, when the processing activity is likely to involve controversial topics, or process data in unexpected ways, seeking the views of data subjects (or their representatives) is likely warranted – especially if the controller cannot otherwise ensure that the specific interests of the data subject are adequately observed and safeguarded.

Gathering these views is particularly relevant when there is an inherent imbalance of power between controllers and data subjects – for example, if they are both employees of the UU. It is less relevant when controllers have no relationship or link with data subjects, where gathering these views would be impractical to do, would be a disproportionate effort, or would compromise the integrity of the research.

For research projects where data subjects’ views cannot be obtained, conducting an ethical review is highly advised, as an ethical assessment can ensure that the interest of data subjects are adequately observed and safeguarded.

Those views can be obtained or inferred through a variety of means, depending on the context. For example, derived from preliminary study results, by engaging with data subject’s representatives, or by directly asking data subjects (or a representative sample of data subjects) for their views. The views can cover the assessment of the risks (step 11), the interests pursued (step 1 and 7) and the scope and nature of the processing (steps 2 to 4). In other words, whether they agree that the processing is indeed necessary and proportional.

Previous: Description of Planned Transfers of Personal Data to Other Countries Outside the EU | Next: Preliminary Risk Assessment