GDPR Consent
Processing personal data is generally prohibited, unless it is expressly allowed by law, or the data subject has consented to the processing. While being one of the more well-known legal bases for processing personal data, consent is only one of six bases mentioned in the General Data Protection Regulation (GDPR). The others are: contract, legal obligations, vital interests of the data subject, public interest and legitimate interest as stated in Article 6(1) GDPR.
The basic requirements for the effectiveness of a valid legal consent are defined in Article 7 and specified further in recital 32 of the GDPR. Consent must be freely given, specific, informed and unambiguous. In order to obtain freely given consent, it must be given on a voluntary basis. The element “free” implies a real choice by the data subject. Any element of inappropriate pressure or influence which could affect the outcome of that choice renders the consent invalid. In doing so, the legal text takes a certain imbalance between the controller and the data subject into consideration. For example, in an employer-employee relationship: The employee may worry that his refusal to consent may have severe negative consequences on his employment relationship, thus consent can only be a lawful basis for processing in a few exceptional circumstances. In addition, a so-called “coupling prohibition” or “prohibition of coupling or tying” applies. Thus, the performance of a contract may not be made dependent upon the consent to process further personal data, which is not needed for the performance of that contract.
For consent to be informed and specific, the data subject must at least be notified about the controller’s identity, what kind of data will be processed, how it will be used and the purpose of the processing operations as a safeguard against ‘function creep’. The data subject must also be informed about his or her right to withdraw consent anytime. The withdrawal must be as easy as giving consent. Where relevant, the controller also has to inform about the use of the data for automated decision-making, the possible risks of data transfers due to absence of an adequacy decision or other appropriate safeguards.
The consent must be bound to one or several specified purposes which must then be sufficiently explained. If the consent should legitimise the processing of special categories of personal data, the information for the data subject must expressly refer to this.
There must always be a clear distinction between the information needed for the informed consent and information about other contractual matters.
Last but not least, consent must be unambiguous, which means it requires either a statement or a clear affirmative act. Consent cannot be implied and must always be given through an opt-in, a declaration or an active motion, so that there is no misunderstanding that the data subject has consented to the particular processing. That being said, there is no form requirement for consent, even if written consent is recommended due to the accountability of the controller. It can therefore also be given in electronic form. In this regard, consent of children and adolescents in relation to information society services is a special case. For those who are under the age of 16, there is an additional consent or authorisation requirement from the holder of parental responsibility. The age limit is subject to a flexibility clause. Member States may provide for a lower age by national law, provided that such age is not below the age of 13 years. When a service offering is explicitly not addressed to children, it is freed of this rule. However, this does not apply to offers which are addressed to both children and adults.
As one can see consent is not a silver bullet when it comes to the processing of personal data. Especially considering that the European data protection authorities have made it clear “that if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.” Strictly interpreted, this means the controller is not allowed to switch from the legal basis consent to legitimate interest once the data subject withdraws his consent. This applies even if a valid legitimate interest existed initially. Therefore, consent should always be chosen as a last option for processing personal data.
Suitable GDPR articles
Art. 4 GDPR Definitions Art. 6 GDPR Lawfulness of processing Art. 7 GDPR Conditions for consent Art. 8 GDPR Conditions applicable to child's consent in relation to information society services Art. 9 GDPR Processing of special categories of personal data Art. 22 GDPR Automated individual decision-making, including profiling Art. 49 GDPR Derogations for specific situations
Suitable Recitals
(32) Conditions for Consent (33) Consent to Certain Areas of Scientific Research (38) Special Protection of Children's Personal Data (40) Lawfulness of Data Processing (42) Burden of Proof and Requirements for Consent (43) Freely Given Consent (50) Further Processing of Personal Data (51) Protecting Sensitive Personal Data (54) Processing of Sensitive Data in Public Health Sector (71) Profiling (111) Exceptions for Certain Cases of International Transfers (155) Processing in the Employment Context (161) Consenting to the Participation in Clinical Trials (171) Repeal of Directive 95/46/EC and Transitional Provisions
External Links
Authorities
Data Protection Authority UK ► GDPR consent guidance
Data Protection Authority UK ► Consent
Data Protection Authority Isle of Man ► Consent
Article 29 Data Protection Working Party ► WP 259 – Guidelines on Consent
European Commission ► Grounds for Processing
European Commission ► When is consent valid?
EU publications ► Handbook on European data protection law – Consent, page 111
Expert contribution
Lukas Zolejnik ► How to: GDPR, consent and data processing
IAPP ► The UX Guide to getting consent
Tilburg University ► Consent now and then
CIPL ► GDPR Implementation In Respect of Children’s Data and Consent
CIPL ► Recommendations for Implementing Transparency, Consent and Legitimate Interest under the GDPR
Oxford University Press ► Commentary on the EU General Data Protection Regulation (GDPR) – Lawfulness of processing, Page 32
For more information, see here: https://gdpr-info.eu/issues/consent/
These materials were obtained directly from the International Government public websites and are posted here for your review and reference only. No Claim to Original International Government Works. These may not be the most recent versions. The International Governments may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information or the information linked to. Please check the linked sources directly.