GDPR written consent requirements

**cojak** · 22 March 2018, 06:19

They are wrong.

There should be a clear request for consent and no pre-ticked boxes are to be used.

I think they probably got confused by the ‘no pre-ticked box’ reference and took it to mean no boxes can be ticked.

https://ico.org.uk/media/about-the-i...ion-201703.pdf

**DaveB** · 22 March 2018, 08:43

Also wrong that Consent is the only option.

There are 6 criteria under which lawful processing can take place, consent is only one if them.

(a) Consent:*the individual has given clear consent for you to process their personal data for a specific purpose.
(b) Contract:*the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
(c) Legal obligation:*the processing is necessary for you to comply with the law (not including contractual obligations).
(d) Vital interests:*the processing is necessary to protect someone’s life.
(e) Public task:*the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
(f) Legitimate interests:*the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

For the other 5 you need to provide a clear, unambiguous Privacy Statement that details what information you will hold, why you hold it, who it may be shared with and what you will do with it. You also have to give the individual the following rights relating to the information you hold.

the right to be informed
the right of access
the right to rectification
the right to erasure
the right to restrict processing
the right to data portability
the right to object
the right not to be subject to automated decision-making including profiling.

**DaveB** · 22 March 2018, 08:48

If you want to go to the source material Article 7 of the GDPR covers consent in conjunction with Recital 32

Article 7 states :

Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.

If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.

The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

Recital 32 states:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.

This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data.

Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

Consent should cover all processing activities carried out for the same purpose or purposes.

When the processing has multiple purposes, consent should be given for all of them.

If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

Recitals 33, 42 and 43 give further context.

**madame SasGuru** · 22 March 2018, 09:39

Originally posted by DaveB View Post

If you want to go to the source material Article 7 of the GDPR covers consent in conjunction with Recital 32

Article 7 states :

Recital 32 states:

Recitals 33, 42 and 43 give further context.

Even that isn't clear

When the processing has multiple purposes, consent should be given for all of them.

Does this mean I can ask once for all purposes or should they be separated out individually - I ask as I'm seeing people doing both.

**DaveB** · 22 March 2018, 09:58

Originally posted by madame SasGuru View Post

Even that isn't clear

Does this mean I can ask once for all purposes or should they be separated out individually - I ask as I'm seeing people doing both.

You can do either. The important bit is that you make it clear what they are consenting to in, clear and unambiguous language, and the consent is freely given.

What you can't do is get consent for one thing and then use the data for something else without telling the subject or their consenting to it.

**Maslins** · 22 March 2018, 11:50

Originally posted by cojak View Post

There should be a clear request for consent and no pre-ticked boxes are to be used.

I think they probably got confused by the ‘no pre-ticked box’ reference and took it to mean no boxes can be ticked.

This was my thoughts. Tick box is fine but the person needs to consciously tick to opt in, rather than default is it's ticked.

GDPR written consent requirements