It can be argued that one of the greatest misunderstandings of GDPR since its inception concerning the obligation to submit a consent to the processing of personal data for the purpose of a Notification for a Certificate of Trade Authorisation. This consent was required by § 46 par. 1) g) of the Trade Licensing Act (No. 455/1991 Coll.) until 31st August 2019.
Incorrect legal basis for processing personal data
For unknown reasons, the above-mentioned consent was an essential requirement for a Notification for a Certificate of Trade Authorisation, as incorporated by the legislator into the wording of the Trade Licensing Act last year, which took effect from 1st September 2018. Consequently, a carousel of discussions and confrontations began not only with district offices which required consent, but also with the Office for Personal Data Protection of the Slovak Republic as a supervisory authority in the area of personal data protection.
The problem with the abovementioned provision is that consent to the processing of personal data should be according to GDPR sought only if the processing of personal data cannot be performed under another legal basis. It is obvious that the processing of personal data of a person notifying his trade should be done on a legal basis of public interest and in the exercise of official authority (Article 1 (e) of GDPR) and not on the basis of the consent of the data subject. Consent, in this case, is a considerably inappropriate legal basis for the processing of personal data, as it must be given freely, which has not been often met when requested by the staff of the district offices. However, what is the most important, a consent can be revoked at any time. Therefore, should such withdrawal of consent occur, the State would be obliged to immediately terminate the processing of personal data for the purpose for which the consent was given which, given the nature of the regulation of a business, would not be objectively possible and justified.
Public criticism and elimination of the contradiction
Despite the criticism of the professional community, which appeared immediately after the amendment of the Trade Licensing Act, it took up to one year for the contradiction to be eliminated. Our law firm, as well as a large number of our colleagues met with this bureaucratic burden and long-term explanation of its groundless nature. We are therefore convinced that this inaccuracy has also been corrected as a result of public pressure on the staff of district offices who refused to give a redundant and baseless consent to the processing of personal data.
In conclusion, the reason of correction of this faux pas by the legislator sounds quite humorously as he stated in the explanatory memorandum of the amendment to the Act that removed the requirement of consent to the processing of personal data, that “requirement of consent of data subjects to the processing of their personal data during notifying of trade for purpose of fulfilment of legal requirements is eliminated, as it is no longer required during the fulfilment of the requirements of the Personal Data Protection Act.” In this regard it should be noted that consent was not needed or requested from the beginning.
With reference to the above, therefore, as of 1st September 2019, the data subjects are not required to submit a consent to the processing of personal data to the district offices when notifying a trade.