Short Reads

Countdown 6 weeks until GDPR: How freely given must the consent be under the GDPR?

Stibbe - How freely given must the consent be under the GDPR?

Countdown 6 weeks until GDPR: How freely given must the consent be under the GDPR?

12.04.2018 EU law

Only 6 more weeks to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

How freely given, specific, informed, and unambiguous must the consent be under the GDPR?

The GDPR qualifies the data subject’s consent as consent that is freely given, specific, informed, and unambiguous. These requirements are substantial elements of a valid consent under the GDPR, which is necessary for the related personal data processing to be lawful. An effective and actual consent to personal data processing by the data subject is, in fact, a core principle of the GDPR.

In light of the above, it is worth clarifying that consent is considered:

a)        freely given if the data subject is (i) actually aware of the elements based on which they give their consent to the data processing; (ii) not conditioned by external circumstantial influences; and (iii) aware of his or her right to withdraw the consent at any time;

b)        specific if the data subject explicitly gives his or her consent to each separate data processing activity envisaged by the data controller;

c)         informed if the data subject - before giving his or her consent - is informed through an intelligible and easily accessible form about the data processing activities envisaged by the data controller; and

d)        unambiguous if there is an objective certainty both regarding the actual existence of the data subject’s consent and the contents of that consent, meaning that the consent must be given through a clear, affirmative act of the data subject (i.e., an ex silentio consent is not a clear, affirmative act, hence not acceptable).

 

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

20.09.2022 EU law
Launch of Metaverse blog series

Articles - Stibbe launches a new blog series focusing on the legal challenges of the Metaverse. In our upcoming blog posts, we will discuss the legal challenges of NFTs, crypto-assets, Metaverse platforms, crypto exchanges, DAO, and many more.

Read more

28.07.2022 NL law
Zuiver commercieel belang ook gerechtvaardigd belang: Raad van State laat zich er niet over uit

Short Reads - Op 27 juli 2022 heeft de Raad van State bevestigd dat de Autoriteit Persoonsgegevens onterecht een boete van € 575.000 aan VoetbalTV heeft opgelegd. De hoop bestond dat de Afdeling antwoord zou geven op de vraag of de AP terecht of onterecht meent dat een zuiver commercieel belang géén gerechtvaardigd belang kan zijn in de zin van de Algemene Verordening Gegevensbescherming. Het antwoord op deze vraag blijft echter uit.  

Read more

28.07.2022 NL law
Purely commercial interest also a legitimate interest? Council of State leaves the question unanswered.

Short Reads - On 27 July 2022, the Council of State confirmed that the Dutch Data Protection Authority wrongly imposed a €575,000 fine on VoetbalTV. But the Council did not answer the question whether the AP rightly or wrongly believes that a purely commercial interest cannot be a legitimate interest within the meaning of the General Data Protection Regulation.

Read more