When issuing city cards with a photo and information about a disability or other criterion entitling the holder to a discount on urban bus fares, is consent to the processing of personal data required?

ANSWER

If the appearance of city cards and the possibility of including a photo on them is regulated by law, the legal basis for processing is the controller's legal obligation – Article 6(1)(c) GDPR. However, if the law does not specify this, data processing takes place on the basis of the transport contract concluded (Article 6(1)(b) GDPR) and does not require separate consent, which would not be freely given. As regards the additional information entitling the holder to discounts, it is appropriate to obtain consent to the processing of such data. If the individual does not give consent, they will not receive the discount, but will still be able to use the city card.