EU data protection rules set down conditions as to when an organisation can process an individual’s data, including with consent or a contract.
Grounds of legitimate interest is a legal ground for processing data, but conditions have to be met under EU law.
Consent is one of the legal grounds for processing personal data under EU law, there are though conditions to respect to ensure it’s valid.
Does consent given before 25 May 2018 continue to be valid once the GDPR starts to apply on 25 May 2018?
Data protection rules post May 2018 change the rules on consent, consent given pre-May 2018 is not always valid.
A person can withdraw consent for the processing of their data under EU law, in certain circumstances. Organisations should enable them to do this.
Consent for processing personal data for scientific research is subject to specific rules under EU data protection law.