Does a contact form need to ask the user for explicit permission to be GDPR compliant?

Question

I have read about GDPR compliance for forms, and from my understanding a contact form is compliant if it has:

• A tick box (unchecked) clearly saying we will contact you back regarding your query
• OR if it's mentioned on the form somewhere clearly that your email address will be used for correspondence regarding your query etc.

But some developers argue that a contact form similar to the one below doesn't require either of the two features mentioned above. According to our developer, the below form is GDPR complaint as it a contact form, not a newsletter form.

He further justifies this by saying that that after the user fills in the form, they get an email saying that their query has been received and we will get back to you asap.

Is this enough?

Or is the below form the correct way of doing it?

Answer 1

I have a contrary opinion on this. I don't believe your checkbox collects any additional consent from the user that just submitting the form does, so I believe the checkbox can be removed because it is useless.

Let's break down the consent language:

I consent to having this website store my submitted information so they can respond to my query.

Firstly:

I consent to having this website store my submitted information.

Well of course this information is going to be stored somewhere, that's how sending a message to someone works. No reasonable user could expect that you would receive their message and immediately delete it before anyone has a chance to read or reply to it.

Secondly:

So they can respond to my query.

No reasonable person would fill out a contact form expecting nobody to respond to what they are saying in any way. That's also an inherent part of what it means to send someone a message - to get someone on the other end to respond to it by taking some action (usually, a reply).

At least one other person seems to agree with me:

Let’s imagine a simple contact form, for example. People are making the choice to get in touch with you and this means they expect you to use their email address to reply to their message. In this case, GDPR consent guidelines don’t apply.

5 Steps to Create GDPR Compliant Forms - Venture Harbour

All that said, I do believe your link to the privacy policy could be very important, since it details exactly how people's data is stored, aside from the consent itself to store the data. The link to the privacy policy makes this consent more informed in a way that the disclaimer doesn't, and so should be left on the form.

And of course, if you do plan to use their email address for something other than replying to their message (such as signing them up for a newsletter), you will need a separate explanation and checkbox.

Finally, this is not legal advice and I am not a lawyer. I just find it a bit silly that the GDPR has people asking questions about what it means to consent to the delivery of a message that you send someone.

Answer 2

GDPR Compliance is Extremely Broad

Anywhere you are collecting user information, then storing said information, and there is the possibility of using that information for future correspondence, will fall under GDPR compliance.

This means you need to get permission to save a contact form your database, or use the information provided by a user through your contact form to respond to their message or inquiry.

Edit after further reading of the text:

However, it also says:

Consent is just one of the legal bases you can use to justify your collection, handling, and/or storage of people’s personal data. Article 6 states five other justifications.

It provides the following alternative legal bases:

1. Processing is necessary to satisfy a contract to which the data subject is a party.

2. You need to process the data to comply with a legal obligation.

3. You need to process the data to save somebody’s life.

4. Processing is necessary to perform a task in the public interest or to carry out some official function.

5. You have a legitimate interest to process someone’s personal data. This is the most flexible lawful basis, though the “fundamental rights and freedoms of the data subject” always override your interests, especially if it’s a child’s data.

It basically says you must do this but you also don't have to do this. In your case, it seems to me your developer is not wrong, but they're also not right.**

I'd use the form shown in the second screenshot in your question. To avoid any issues and speak to a lawyer if you're really against having it.

Although in your example it's just a contact form, if you can foresee ever using the info of users that submit it for any other forms of communication like a news, events, or offers I'd keep it and include a second checkbox that says "Yes, keep me updated with Example Company news, events, and offers."

I'd recommend reviewing this general checklist.

It Doesn't Just Apply to EU based Companies/Sites

While GDPR is an EU law, any business or organization that makes their website or products and services available to EU based users must comply with it or risk hefty fines. Even entities based in the United States have to comply with GDPR.

View the GDPR compliance checklist for US companies.

The inclusion of or website means it extends to more than just commerce. By that language, if you have internationalized your website with something like hreflang or use ccTLD of an EU country, you'd have to comply.

Defining Personal Data

GDPR Article 4 gives the following definition for personal data:

‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Further reading on personal data

Ensure That Your Privacy Policy Contains Proper Information

If you're collecting data directly from a user, GDPR cites the following be included in a "privacy note" or "privacy policy":

• The identity and contact details of the organization, its representative, and its Data Protection Officer
• The purpose for the organization to process an individual’s personal data and its legal basis
• The legitimate interests of the organization (or third party, where applicable)
• Any recipient or categories of recipients of an individual’s data
• The details regarding any transfer of personal data to a third country and the safeguards taken
• The retention period or criteria used to determine the retention period of the data
• The existence of each data subject’s rights
• The right to withdraw consent at any time (where relevant)
• The right to lodge a complaint with a supervisory authority
• Whether the provision of personal data is part of a statutory or contractual requirement or obligation and the possible consequences of failing to provide the personal data
• The existence of an automated decision-making system, including profiling, and information about how this system has been set up, the significance, and the consequences

Here is an example of a GDPR compliant privacy policy