1

TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant?

An organisation I am part of has an online form on their intranet for reporting incidents and near misses.

The other day I was going to use this form to submit a tech. incident report. I opened up the form, but then realised it was not the correct place to submit the report and closed the window.

Later that day I received an automated email with a reference number for the report thanking me for ‘sending it in’ and nothing that ‘the form was only partially completed.’

I raised this with somebody, who raised it to the national HQ. They forwarded me the reply they received, where the NHQ confirmed that the behaviour was intentional and was ‘a failsafe as such in case of a loss of network connection’.

I have never seen this used elsewhere—it almost seems like a well-intentioned use of the privacy zuckering dark pattern. There was no indication prior to accesing the form, or on the form itself, that it would autosubmit after interaction regardless of whether the 'Submit' button was clicked or not.

Is this legal under the GDPR/Data Protection Act 2018 (as it is a UK organisation)?

Recital 32 of the preamble to the GDPR states that:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.

..which seems to pretty clearly exclude an automatic submission.

That said, perhaps there is an Art. 6, para. 1(c) or (d) exemption at play here, as workplace incident reporting is a statuatory duty under the Health and Safety at Work etc Act 1974.

4
  • Which personal data (that the organization you belong to does not already have) would be involved? If there is no personal data, then GDPR just does not apply.
    – SJuan76
    Nov 14, 2019 at 10:35
  • @SJuan76 As you have to sign into the intranet to access the form, they will already have your details. However, the form has a text field where you input details about the incident/near miss you are reporting. My concern is that somebody may enter something sensitive into that field—potentially including personally-identifiable information of others—yet decide against submitting it for whatever reason, but nonetheless have it submit itself anyway without their consent.
    – 08915bfe02
    Nov 14, 2019 at 10:45
  • 4
    @Rumps Please don't refer to "personally identifiable information" in the context of GDPR. PII is a term of art in American data protection. GDPR deals in "personal data" (and has special rules for "sensitive personal data"). Many things (like IP addresses) may be PD, but are not PII. Nov 14, 2019 at 11:52
  • Really interesting, as I was asked to look into something similar recently. Martin is right that an IP address is (usually) personal data and therefore in scope of the GDPR. I'll see if I can put together a full answer.
    – Sam_Butler
    Nov 18, 2019 at 16:50

2 Answers 2

2

Because this is a requirement of the HSWA, the lawful basis is not consent, but rather GDPR Art. 6(1)(c):

processing is necessary for compliance with a legal obligation to which the controller is subject

It is also important to identify whether any personal data are indeed being collected and transmitted with this form, as it is this that establishes whether the activity falls within the scope of the GDPR.

In answer to your question, that the form automatically submits the user's input does not make the form either compliant or non-compliant. Depending on what data is being collected, there may be a need to conduct an impact assessment, inform the supervisory authority, or indeed seek (or have sought) consent. So an auto-submitting form is not automatically noncompliant with the GDPR (or UK Data Protection Act 2018).

0

Why would consent be the legal basis for collecting personal data here?

It’s a work health and safety incident report. As such, this falls under a legitimate business reason for collection - consent is not required.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .