GDPR and forums: &quot;Lawfulness of processing&quot; email addresses used only for providing the service
<p>I run a small hobby message board that is entirely non-commercial.
People need to provide an email address to register and use that for logging in.</p>

<p>I do not use their email address for anything else (unless they set their profile so that they receive notifications on topic replies or private messages, or if they want to reset their password), and I describe this clearly before registration. Email addresses are never transferred to any third parties, nor are they used for sending any unsolicited messages.</p>

<p><strong>Is this considered a "lawful basis for processing data"? Or is consent required?</strong></p>

<p>It would be important to not require additional consent as I would like the forum to be friendly for teenagers as well, and asking them to print a form and get it signed by their parents is just <em>plain ridiculous</em> and it would turn most of them away (or just cause them to lie about their age instead).</p>

<p>Yes, it is fine, but you are required to <a href="https://gdpr-info.eu/art-30-gdpr/" rel="nofollow noreferrer">write down why</a>.</p>

<p>I think you can mostly base the processing on <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Article 6.1b GDPR</a>;</p>

<blockquote>
  <p>b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;</p>
</blockquote>

<p>When someone registers there is a mutual contract. You need the email address of the other party to be able to contact them. You already mentioned a password reset. But there will be other important reasons to contact them, for example <a href="https://gdpr-info.eu/art-34-gdpr/" rel="nofollow noreferrer">Article 34 GDPR</a> requires you to inform everyone in case of a personal data breach. It is very common to also use the email address to login, it is even better than having to enter additional personal data.</p>

<p>Assuming notifications on topic replies or private messages are disabled by default, it is a perfect way for users to give consent by ticking a check box. So <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Article 6.1a GDPR</a> would apply to that"</p>

<blockquote>
  <p>a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;</p>
</blockquote>

<p>They should be able to disable these notifications at any time. </p>

<p>If these notifications would improve the discussions, for example because of faster replies, <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Article 6.1f GDPR</a> might even apply;</p>

<blockquote>
  <p>f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, [...]</p>
</blockquote>

gdpr social-media