Data Core · Data Collection · Module
Consent and basis
What the organisation is entitled to collect and hold, on what basis, and what it has told people.
The idea
How it works
What is technically capturable and what the organisation is entitled to hold are different sets, and the second is smaller. Collection decisions made purely technically produce obligations nobody assessed.
Purpose limitation is the constraint that matters operationally: data collected for one purpose cannot simply be used for another, and the useful new analysis is frequently the one that would breach it.
Working with it
In practice
- 01
Record the basis per data set
Consent, contract, legitimate interest or obligation. Each has different consequences for what you may then do.
- 02
State the purpose at collection
And keep to it. A later use outside the stated purpose needs its own basis.
- 03
Collect less
Data collected because it might be useful is an obligation with no offsetting benefit until it is used.
- 04
Check what people were actually told
The privacy notice is a commitment. Practice that has drifted from it is a breach regardless of intent.
One level in
The components of consent and basis
A component is something that exists afterwards which did not exist before — a deliverable or a mechanism, not an intention.
Data collected because it might be useful is an obligation with no benefit until it is actually used.
The other modules in data collection
The sources
Where data actually comes from, and which source is authoritative where several disagree.
LearnInstrumentation
What is deliberately captured and how — the design decision that determines which questions the organisation will ever be able to answer.
LearnData quality
Whether the data is complete, accurate, timely and consistent — measured rather than assumed, since the assumption is always that it is fine.
Learn