What provisions should I make regarding GDPR consent when users do not sign themselves up?

Question

In my business, users are signed up by staff, according to user lists (name, email address only) provided by our clients.

We track user interactions with our site in order to monitor usage and engagement.

Under GDPR, it looks like we should be asking for separate consent for this monitoring, since it is not required to use the service itself. Is this correct? If we write such requirements for consent into our contracts with our clients is this sufficient or do we need to obtain it on an individual basis, e.g. after first login? Obviously we would still provide the ability to opt-out of this tracking via a user's profile.

I guess it boils down to whether we are a controller or a processor for these data. Since only the controller needs to obtain consent, if we are just a processor that makes our life considerably easier.

Answer 1

We track user interactions with our site in order to monitor usage and engagement. Under GDPR, it looks like we should be asking for separate consent for this monitoring, since it is not required to use the service itself. Is this correct?

No. Processing personal data for the website statistic purposes (so you can improve its user interface, menu and content structure, database performance, count visitors etc.) is considered to be compatible with the initial purpose of the processing.

Article 5(1) point (c):

1. Personal data shall be: (...) (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);

Answer 2

You'll know if you're a processor

The statement "I guess it boils down to whether we are a controller or a processor for these data." raises a few questions - while it may be relevant to discuss whether you would prefer to be a controller or a processor for this data, in any current situation it's quite simple to verify. The only way how you can be a processor is if specific agreements with the controller(s) declare it so. (GDPR Article 28-3 states what that agreement must contain). Do you have such agreements?

If you're currently planning on how to handle this, you may "take the initiative" and provide standard agreements with your corporate clients that state that they're the data controller (with all the associated problems and liabilities, which they may be reluctant to accept) and you're processing this data on their behalf.