1

This question already has an answer here:

If I have a form on a website where people fill in their personal details and credit card information to subscribe to a monthly delivery of apples, do I need an active consent (e.g. checkbox) from the user in order to store his or hers data?

The personal data will only be used to deliver apples and nothing else. Do I still need an active consent from the user? It would seem to me that the user already understands that the personal information is used to deliver apples, and an extra checkbox would seem superfluous?

Or would I only need an extra consent if the data is used for something non-obvious?

marked as duplicate by SJuan76, Paul Johnson, BlueDogRanch, Nij, Dale M Jan 25 at 3:15

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • @SJuan76, here we have simple processing of personal data to buy/sell things while in the other we have a contact form and e-mail messaging where additional unspecified and unwanted data can be transferred. – Grzegorz Adam Kowalski Jan 20 at 20:42
1

Short answer:

In your case (delivering apples), no.

Long answer:

You asked:

do I need an active consent (e.g. checkbox) from the user in order to store his or hers data?

No, for "common" personal data (name, e-mail, address, credit card info), you don't. Article 4(11) states:

‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Filling in personal details and credit card information is a clear affirmative action and an indication of will.

Your next question:

Or would I only need an extra consent if the data is used for something non-obvious?

Explicit consent is required only when you're processing data about race, religion, sex life, sexual preferences and other sensitive data as listed in Article 9 of GDPR:

  1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
  2. Paragraph 1 shall not apply if one of the following applies: (...) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

Not the answer you're looking for? Browse other questions tagged or ask your own question.