Consent as a legal basis for data processing

Conditions for valid consent

Recital 32 of the GDPR states: Consent should be given by a clear affirmative act, such as a written statement, including by electronic means, or an oral statement. Consent must be freely given, specific, informed and unambiguous.

This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should therefore not constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

Consent given by the data subject must meet certain conditions under the GDPR. The rules of thumb are as follows:

• Consent must be freely given;
• Consent must be unambiguous;
• The organisation must inform the data subject about the data processing;
• Consent must be specific;
• Consent may be withdrawn by the data subject at any time. The data subject must be made aware of this.

In short, consent must be freely given, specific, informed and unambiguous. Below, we discuss the individual elements of consent in more detail.

Unambiguously given consent

Consent must result from a clear affirmative act by the data subject. It must be clear that consent has been given. The legislator is clear about when unambiguous consent can or cannot exist.

This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should therefore not constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

Informing the data subject about consent

The controller must inform the data subject in advance what the consent is being given for and to whom. An organisation must therefore make clear which organisation is requesting consent, which personal data will be processed and for what purposes. The information must be offered to the data subject in an accessible and understandable way. A good way of doing this is to draw up a privacy statement and publish it on the website.

Being able to withdraw consent

Under the GDPR, the data subject may withdraw previously given consent at any time. You must inform the data subject of this. In addition, it must be as easy to withdraw consent as it was to give it. For example, you may not require a customer to submit a request by post if the customer gave consent when filling in an online form or making an online purchase. Nor may you impose unreasonable requirements on the data subject if the data subject wishes to withdraw consent.