Only 6 more weeks to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.
How freely given, specific, informed, and unambiguous must the consent be under the GDPR?
The GDPR qualifies the data subject’s consent as consent that is freely given, specific, informed, and unambiguous. These requirements are substantial elements of a valid consent under the GDPR, which is necessary for the related personal data processing to be lawful. An effective and actual consent to personal data processing by the data subject is, in fact, a core principle of the GDPR.
In light of the above, it is worth clarifying that consent is considered:
a) freely given if the data subject is (i) actually aware of the elements based on which they give their consent to the data processing; (ii) not conditioned by external circumstantial influences; and (iii) aware of his or her right to withdraw the consent at any time;
b) specific if the data subject explicitly gives his or her consent to each separate data processing activity envisaged by the data controller;
c) informed if the data subject - before giving his or her consent - is informed through an intelligible and easily accessible form about the data processing activities envisaged by the data controller; and
d) unambiguous if there is an objective certainty both regarding the actual existence of the data subject’s consent and the contents of that consent, meaning that the consent must be given through a clear, affirmative act of the data subject (i.e., an ex silentio consent is not a clear, affirmative act, hence not acceptable).
Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.