A charity collected donor emails on consent for a fundraising campaign, then silently switched to legitimate interests after many donors withdrew consent. What is the main GDPR concern with that mid-campaign basis swap?
Select an answer to reveal the explanation.
Short Explanation
You cannot bait-and-switch the legal story after someone says stop. Swapping from consent to legitimate interests just to dodge withdrawal is bad practice, and subjects still need clear notice about what you are doing and why.
Full Explanation
Lawful bases should be identified up front with transparency about purposes and grounds. EDPB guidance cautions against retrospectively switching bases to circumvent the consequences of consent withdrawal. Legitimate interests is a distinct Art. 6 ground requiring its own assessment and notice, not an automatic fallback. Charities remain subject to Art. 6, and while another basis might lawfully apply to compatible processing in limited cases, it cannot be used as a quiet evasion of withdrawal without meeting transparency and lawfulness requirements.