Short Reads

Countdown 6 weeks until GDPR: How freely given must the consent be under the GDPR?

Stibbe - How freely given must the consent be under the GDPR?

Countdown 6 weeks until GDPR: How freely given must the consent be under the GDPR?

12.04.2018 EU law

Only 6 more weeks to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

How freely given, specific, informed, and unambiguous must the consent be under the GDPR?

The GDPR qualifies the data subject’s consent as consent that is freely given, specific, informed, and unambiguous. These requirements are substantial elements of a valid consent under the GDPR, which is necessary for the related personal data processing to be lawful. An effective and actual consent to personal data processing by the data subject is, in fact, a core principle of the GDPR.

In light of the above, it is worth clarifying that consent is considered:

a)        freely given if the data subject is (i) actually aware of the elements based on which they give their consent to the data processing; (ii) not conditioned by external circumstantial influences; and (iii) aware of his or her right to withdraw the consent at any time;

b)        specific if the data subject explicitly gives his or her consent to each separate data processing activity envisaged by the data controller;

c)         informed if the data subject - before giving his or her consent - is informed through an intelligible and easily accessible form about the data processing activities envisaged by the data controller; and

d)        unambiguous if there is an objective certainty both regarding the actual existence of the data subject’s consent and the contents of that consent, meaning that the consent must be given through a clear, affirmative act of the data subject (i.e., an ex silentio consent is not a clear, affirmative act, hence not acceptable).

 

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

05.11.2021 EU law
European Strategy for Data: short analyse of the proposed regulation of data governance (Data Governance Act)

Articles - On 25 November 2020, the European Commission published a proposal for a regulation on data governance  and a related Q&A. On 1st October 2021, the Council of the European Union agreed position on Data Governance Act. That will allow the Council presidency to start negotiations with the European Parliament. Both the Council and the European Parliament will need to agree on the final text. This blog briefly present the proposal of the European Commission.

Read more