A charity collected donor emails on consent for a fundraising campaign, then silently switched to legitimate interests after many donors withdrew consent. What is the main GDPR concern with that mid-campaign basis swap?
Select an answer to reveal the explanation.
Short Explanation
You cannot bait-and-switch the legal story after someone says stop. Swapping from consent to legitimate interests just to dodge withdrawal is bad practice, and subjects still need clear notice about what you are doing and why.
Full Explanation
Controllers choose and disclose a lawful basis before (or at) processing and must be transparent about it. Silently switching from consent to legitimate interests after many donors withdrew consent looks like an attempt to evade withdrawal rather than a principled reassessment. Even where another basis might theoretically apply to some processing, Article 5 fairness and transparency, Articles 12–14 information duties, and the practical effect of Article 7(3) withdrawal mean the organisation cannot treat withdrawal as a paperwork inconvenience to be patched by a quiet basis swap. Civic-facing charities and public-interest fundraisers especially owe donors clear notice when purposes, bases, or continued contact practices change.
Legitimate interests do not automatically replace consent whenever a data subject objects or withdraws; objection under Article 21 and withdrawal of consent are distinct rights with distinct effects, and neither licenses a stealth conversion. Charities are not exempt from Article 6 once a campaign has launched—material scope and lawfulness continue for the life of the processing. Withdrawal of consent does not permanently freeze a record so that no other basis can ever apply in every conceivable scenario, but any alternative basis must be valid for the purpose, necessary, compatible with what was told to donors, and cannot be used merely to circumvent withdrawal.
Exam caveat: the “no switching to avoid withdrawal” teaching point is about fairness and abuse of bases, not a claim that bases can never be reviewed when purposes lawfully change with fresh notice. Watch for fact patterns that distinguish a genuine new purpose with proper information from mid-stream evasion.
Operational check: map each donor-processing purpose to one documented basis; if consent is withdrawn, stop that consent-based processing, suppress marketing as required, update notices before any continued contact on another basis, and retain evidence of the decision trail for supervisory review.