Processing personal data on the basis of consent

Consent is any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

In this article we look at obtaining, recording and processing personal data on the basis of consent given by the data subject under Article 6(1)(a) or Article 9(2)(a) of Regulation (EU) 2016/679 (the “Regulation”).

Two terms recur in the text:

• The data subject is any natural person to whom the personal data relate;
• The controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Giving consent

A request for consent must be concise and specific, in an easily understandable form. Consent is valid only if it was freely given. It cannot be made a condition of, or forced in exchange for, something else (for example by refusing to conclude a contract or to provide goods or a service). Consent cannot be hidden in terms and conditions; it must be kept separate from any other information. If you want consent for different purposes of processing, you need to ask data subjects for a separate consent for each specific purpose.

(Recital 43) — “Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent, despite such consent not being necessary for such performance.”

When can I process personal data on the basis of consent

You process data subjects’ personal data on the basis of consent where you have no other suitable legal basis for the processing, for example:

• processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary in order to protect the vital interests of the data subject or of another natural person;
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Examples of ways to give consent

• signing a consent statement on a paper form
• ticking a consent box on paper or electronically
• clicking a sign-up button (for example when subscribing to a newsletter)
• choosing between equally prominent yes/no options
• replying to an e-mail asking for consent
• answering yes to a clear request for consent recorded by audio or audiovisual equipment

Where Article 6(1)(a) of the Regulation applies to an offer of information society services directly to a child, Article 8(1) sets the age at which the child can consent at 16 and allows Member States to provide by law for a lower age, not below 13 years. Below that age, the processing is lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Which age applies is therefore set by national law.

The use of pre-ticked opt-in boxes is invalid under the GDPR.

Keeping consents

Where processing is based on consent, the controller must be able to demonstrate that the data subject has consented. In practice that means keeping a record of each consent for as long as the processing relies on it, in a safe place — so that you can show it at the request of the data subject or of the supervisory authority.

Record consent given:

• through online forms or services together with a timestamp, i.e. the date and time the consent was given, and keep a copy of the version of the form used when consent was given, together with any other relevant documents in use;
• in writing through the relevant document or form with the date of consent and the data subject’s signature;
• orally through audio or audiovisual equipment so that the recording shows the date and time it was made.

A parent’s consent does not lapse automatically when the child reaches the age at which they can consent themselves, but it is good practice to give the data subject the opportunity to confirm, modify or withdraw it.

A request for consent contains in particular:

• the contact details of the organisation that will process the personal data (the controller), or of the other organisations if the processing is carried out by several of them (joint controllers)
• the purpose of the processing
• the processing operations
• the legal basis of the processing
• the categories of personal data processed for the purpose
• information on how long the personal data will be processed
• information that consent can be withdrawn at any time before the end of the processing period for which it was given, and how the data subject can withdraw it

You must also make sure that you give data subjects enough information about data protection to meet their right to information under Article 13 of the Regulation. This additional information does not have to be part of the request for consent; it can be an annex or a link to the information on processing, where there is more room for a layered approach.

Handling the consents you obtain

Look after the consents you obtain. Make them available only to authorised persons and contractual partners. Do not use the data for another purpose without first checking whether that purpose is compatible with the one for which they were obtained.

If something changes, you will need to renew them — for example, if your processing operations or purposes evolve, the original consent may no longer be specific or informed enough. If you have any doubt whether a consent you hold is still valid, renew it.

Withdrawing consent

The data subject has the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. It must be as easy to withdraw consent as to give it.

Example — The controller obtained consent to the processing of personal data from the data subject by telephone. The data subject later decides to withdraw that consent. The controller should provide a telephone number for anyone who wants to withdraw their consent.

Withdrawal also applies to special categories of personal data processed on the basis of explicit consent. So if you rely on explicit consent as your condition under Article 9 and the data subject withdraws it, you can no longer rely on it. Do not throw consents given on paper into the bin; destroy them by shredding or burning. If you cannot do that yourselves, use a company that destroys documents, and ask for a record of the destruction.

If you have any questions, get in touch.

Taken over from our previous website.