Why 'We Need Your Consent' Is the Wrong Basis for Course Evaluation

Ask a university how its course evaluation is lawful under data-protection law and you will usually hear the same answer: "students consent." It is on the survey landing page - by continuing, you consent to... It sounds careful and respectful. Under the GDPR, it is usually the wrong lawful basis, and choosing it is not a harmless technicality. It quietly breaks the process it is meant to protect.

The thesis: for a public university running course evaluation as part of its institutional quality function, the appropriate lawful basis under Article 6 is normally public task - Article 6(1)(e) - or, where national quality-assurance law compels it, legal obligation under 6(1)(c). It is almost never consent. And the reason matters, because "consent theatre" creates obligations you cannot meet and misleads students about a control they do not really have. (This is general information, not legal advice; confirm the right basis with your data-protection officer.)

The six bases, and why the default choice is wrong

GDPR Article 6(1) offers exactly six lawful bases for processing personal data: consent, contract, legal obligation, vital interests, public task, and legitimate interests (Art. 6 GDPR, gdpr-info.eu). They are not a menu ranked by virtue. You pick the one that actually fits the processing - and for institutional course evaluation, consent fits badly for two structural reasons.

Consent must be freely given - and a university is a textbook power imbalance. Recital 43 is unusually blunt: consent should not provide a valid legal ground "where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given" (Recital 43, gdpr-info.eu). A student's relationship with their university is close to the paradigm case of imbalance. The UK's ICO puts the operational conclusion plainly: public authorities carrying out their public functions should generally rely on public task, not consent (ICO, what is valid consent).

Consent must be withdrawable - and evaluation usually cannot honour that. Article 7(3) gives the data subject the right to withdraw consent at any time, and it must be as easy to withdraw as to give. If your evaluation is institutionally required, or if responses are pooled and analysed the moment they arrive, the promise implied by "consent" - you can take this back - is one you cannot keep. You have told the student they hold a lever that does not exist.

Why the wrong basis actively harms the process

This is where it stops being pedantry. Relying on invalid consent means the processing has, in law, no valid basis at all - it is unlawful, dressed up as choice. Worse, it corrupts the very voluntariness it pretends to offer. A student who believes participation is a matter of consent, in a context where it is effectively expected, is being asked to perform a choice that is not real. That is not more ethical than naming the true basis; it is less honest.

There is a subtler cost too. Once you have leaned on consent, you owe every consent obligation: granular opt-in, effortless withdrawal, and re-papering the basis whenever the purpose shifts. Institutions end up either breaching those duties or building elaborate consent machinery around a process that never needed it.

Public task is not a free pass

Switching to public task is the right move, but it must be understood honestly, not as a loophole. Article 6(1)(e) processing still requires a clear, documented basis in law or public function; it still demands transparency (a truthful privacy notice), necessity and proportionality, and it carries its own data-subject right - the right to object under Article 21, which you must be able to handle. And critically, the free-text comments that make evaluation valuable routinely contain special-category data under Article 9 - disclosures about health, religion, sexual orientation - which needs a separate Article 9 condition (commonly substantial public interest with a member-state law basis) on top of the Article 6 basis. We covered that layer in special-category data in free-text feedback. Public task answers "may we process this at all"; it does not answer the Article 9 question, and it is not a shortcut.

The strongest objections

"Surely consent is the most privacy-protective, most respectful basis - let students choose." This is the intuition that keeps consent on evaluation landing pages, and it is wrong on GDPR's own terms. An invalid consent is not protective; it is unlawful processing wearing the costume of choice. In a power-imbalanced setting, consent is not a real choice at all (Recital 43). The ethical goal - genuine voluntariness and honest information - is better served by naming the correct public-task basis, writing a truthful privacy notice, honouring the right to object, and letting genuinely optional questions be genuinely optional, than by consent theatre that promises a withdrawal you cannot deliver.

"We rely on public task, so we don't really need to tell students anything." Also wrong, in the other direction. Public task removes the consent formalities; it does not remove transparency, fairness, minimisation, the right to object, or the Article 9 requirement for sensitive free text. It changes which obligations you carry, not whether you carry them.

"Our surveys are anonymous, so none of this applies." Only if the data is truly anonymous in the Recital 26 sense - and most "anonymous" evaluation is merely pseudonymous. Free-text comments can re-identify a respondent through writing style and specific detail, as we discussed in stylometric re-identification and the distinction between anonymity and confidentiality. If re-identification is realistically possible, GDPR still applies and the basis question does not vanish.

Where Koji fits

Getting the lawful basis right is a governance decision your institution makes; no tool makes it for you. What a well-designed platform can do is make the honest version easy to operate. Koji for Education lets you configure evaluation so the privacy notice reflects the real basis - public task, not manufactured consent - and so genuinely optional items are handled as what they are. Its data minimisation means you collect only what the evaluation needs, which shrinks the footprint and, where you choose to run a truly identifier-free study, can keep some collection outside GDPR's scope altogether by design. The platform handles special-category free text as the Article 9 question it is, rather than burying it in a checkbox. And because the same data-protection-by-design engine runs general user research on the main Koji platform, the model is consistent across an institution that also does non-student research.

Framed honestly: Koji mitigates the risk of consent theatre by making the lawful basis explicit and the privacy notice truthful. It does not choose your basis, and it does not replace your DPO's judgement.

If you want course evaluation that rests on the right lawful basis and a privacy notice you can defend, talk to the Koji for Education team.

Frequently asked questions

What is the correct GDPR lawful basis for course evaluation? For a public university running evaluation as part of its quality function, it is normally public task under Article 6(1)(e), or legal obligation under 6(1)(c) where national quality-assurance law requires it - not consent. Confirm the specific basis with your data-protection officer.

Why is consent usually the wrong basis? Because consent must be freely given and freely withdrawable. Recital 43 says consent is unlikely to be valid where there is a clear imbalance of power, especially where the controller is a public authority - which describes the student-university relationship - and a quasi-mandatory process cannot honour the Article 7(3) right to withdraw.

Isn't consent the most privacy-friendly choice? No. An invalid consent is unlawful processing presented as choice, and in a power-imbalanced setting it is not a genuine choice. Honest information and a correct public-task basis, with a real right to object, protect students better than consent theatre.

Does relying on public task mean we need nothing else? No. Public task still requires transparency, necessity and proportionality, and the right to object under Article 21. Special-category free-text disclosures additionally need a separate Article 9 condition. It changes which obligations apply, not whether they apply.

What if our evaluation is anonymous? GDPR falls away only if the data is truly anonymous under Recital 26. Most evaluation is pseudonymous, and free text can re-identify respondents, so the lawful-basis question usually still applies. Treat "anonymous" as a claim to be tested, not assumed.

Can Koji choose our lawful basis for us? No - that is a governance decision for your institution and its DPO. Koji makes the honest version easy to run: a privacy notice that reflects the real basis, data minimisation, a genuine-anonymity option by design where appropriate, and proper handling of special-category free text.