When explicit consent or existing contracts (employment contract, cooperation agreement) are used as the basis for IAM processing, what must be checked?
Whether these arrangements actually cover the IAM processing or need to be supplemented; consent is typical for B2C, employment contracts for B2E and cooperation agreements for B2B.
The mapping by relationship type:
- B2C (customers): usually explicit consent, given when the customer registers. Consent must be freely given, specific and informed, and it can be withdrawn at any time, so the IAM must be able to react (stop processing, delete).
- B2E (employees): the employment contract and the processing needed to perform it. Consent is weak here, because employees are rarely free to refuse their employer.
- B2B (partners): a cooperation agreement with the partner company, which in turn must cover passing on its staff's data.
The trap: these contracts were written for another purpose (paying salaries, selling products). The questions to ask are "Do these regulations also cover IAM?" and "Are additions necessary?" An employment contract that justifies payroll processing in the HR system does not automatically justify sending the same data to a central IAM in another company, deriving roles from it, and passing it to fifty applications.
The overall advice: analyse the data-protection situation carefully, then get legal advice.
Go deeper:
Art. 7 GDPR: Conditions for consent — proof of consent and the right to withdraw it at any time.- Swiss FADP, Art. 31: Grounds for justification — consent, overriding interests (including contract performance) and law as the Swiss justifications.