In the case of entering into business relations with clients (bank), the law prescribes a mandatory listing of all persons related to the client, with first/surname, unique citizen identification number (EMBG), etc. Does this situation require consent to the processing of the personal data of the related persons specified by the client of the bank?

No.

According to Article 10, paragraph (1) of the ZZLP, there are six legal bases for processing personal data:

• consent;
• contract;
• legal obligation;
• substantial interests;
• public interest/public authority;
• legitimate interest.

There must be an appropriate legal basis for any processing of personal data. Hence, the legal basis for processing personal data through a contract between a bank and a client is the contract.

For other categories of data the legal basis may be a legal obligation of the controller.

Consent is only one of the six legal bases prescribed by law. If there is a legal basis for any specific processing, there is no need to use consent.