TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant?
An organisation I am part of has an online form on their intranet for reporting incidents and near misses.
The other day I was going to use this form to submit a tech. incident report. I opened up the form, but then realised it was not the correct place to submit the report and closed the window.
Later that day I received an automated email with a reference number for the report thanking me for ‘sending it in’ and nothing that ‘the form was only partially completed.’
I raised this with somebody, who raised it to the national HQ. They forwarded me the reply they received, where the NHQ confirmed that the behaviour was intentional and was ‘a failsafe as such in case of a loss of network connection’.
I have never seen this used elsewhere—it almost seems like a well-intentioned use of the privacy zuckering dark pattern. There was no indication prior to accesing the form, or on the form itself, that it would autosubmit after interaction regardless of whether the 'Submit' button was clicked or not.
Is this legal under the GDPR/Data Protection Act 2018 (as it is a UK organisation)?
Recital 32 of the preamble to the GDPR states that:
Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.
..which seems to pretty clearly exclude an automatic submission.
That said, perhaps there is an Art. 6, para. 1(c) or (d) exemption at play here, as workplace incident reporting is a statuatory duty under the Health and Safety at Work etc Act 1974.
