Short Reads

Countdown 5 weeks until GDPR : How should valid consent be proven?

Stibbe - How should valid consent be proven?

Countdown 5 weeks until GDPR : How should valid consent be proven?

19.04.2018 EU law

Only 5 more weeks to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

How should valid consent be proven?

Article 7 of the GDPR reads: “the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data”. However, the GDPR does not contain specific, compulsory provisions in relation to the conditions for proving how the consent was given or obtained.

In that respect, the GDPR is inconsistent with the provisions of certain previous national legislations implementing Directive 95/46/EC (such as, e.g., the Italian Legislative Decree no. 196 of June 30, 2003, whereby the data subject’s consent could be deemed to be effective only if it is “documented in writing”).  

As a consequence, data controllers have the right to demonstrate how the valid consent was obtained by using any means allowed under their legal systems. In that respect, the use of any means for keeping a record of the data subjects’ consent - such as, for example, written statements, also statements stored by electronic means, or tick boxes to be set on internet websites specifically addressing the consent to be sought for the envisaged data processing activities - could be recommended.

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

18.02.2019 EU law
Erik Valgaeren moderates a panel on Data Governance and Compliance during IBA's Silicon Beach Conference

Speaking slot - The discussion topic will cover various legal aspects relating to data lifecycle management, both for personal and non personal data. These aspects will include rights in and obligations regarding data, such retention obligations and portability rights. Practical suggestions on holistic data management and the role of the chief data officer will be debated.

Read more

22.02.2019 BE law
Sarah De Wulf on challenges of SAP contracts and indirect use during a Beltug seminar.

Speaking slot - Sarah De Wulf, junior TMT associate, discusses SAP licensing agreements during a Beltug seminar on 20 February 2019. Many of the Beltug members are customers of SAP and face daily questions and challenges regarding SAP's software licensing policies.  These questions include (among others): how the licence models will evolve (especially in terms of the growth of cloud services) and how to cope with indirect access.

Read more

18.02.2019 NL law
Brexit and data protection: preparing for a 'no-deal'

Short Reads - As it stands, the UK will exit the European Union at midnight on 29 March 2019. Therefore, businesses within the UK, or with trade relations with the UK, would be best advised to assume that a no-deal Brexit is inevitable. The exchange of personal data  within the EU is governed by the General Data Protection Regulation (GDPR). In a no-deal Brexit, the GDPR will cease to be applicable in the UK upon its EU exit.

Read more

Our website uses cookies: third party analytics cookies to best adapt our website to your needs & cookies to enable social media functionalities. For more information on the use of cookies, please check our Privacy and Cookie Policy. Please note that you can change your cookie opt-ins at any time via your browser settings.

Privacy – en cookieverklaring