GDPR: Consent to the processing of personal data
When should consent be required and when should it not? Why does it deserve proper attention? Even years after the GDPR Regulation took effect, consent is often used incorrectly. Consent as a legal basis It is one of the six legal bases that permit the processing of data subjects’ personal data. The GDPR Regulation defines […]
Čo v článku nájdete:
When should consent be required and when should it not? Why does it deserve proper attention? Even years after the GDPR Regulation took effect, consent is often used incorrectly.
Consent as a legal basis
It is one of the six legal bases that permit the processing of data subjects’ personal data. The GDPR Regulation defines consent as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they signify agreement to the processing of personal data relating to them.”
In practice, businesses and employers often use consent whenever personal-data protection is mentioned:
- employment contract: The employment contract says: “The employee consents to the employer processing personal data to perform the contract.” In this case, the obligations arise for the employer from the employment contract or applicable legislation. Consent is not an appropriate legal basis. The legal basis is performance of contractual or legal obligations.
- e-shop: The final checkout step says: “By purchasing, you consent to the processing of personal data.” Here the business must fulfil contractual and legal obligations—keep accounting records, process the order and possibly handle a complaint. The legal basis for some purposes is a contractual obligation and for others a legal obligation.
- cameras: A sign at the entrance says: “By entering these premises, you consent to monitoring and recording.” Monitoring is usually based on the legitimate interest in monitoring the premises (public authorities may apply the public-interest basis).
Consent should be requested only in relevant cases, not where it is unnecessary.
The legal bases under the GDPR Regulation are equal. For each processing purpose, the most appropriate basis must be selected and justified. The choice may be supported by referring to legal rules (for example, for legitimate or public interest where the law provides that an entity “may” perform certain activities).
Conditions for valid consent
Consent is valid only if it is (a) freely given and specific, (b) informed and (c) an unambiguous indication of the data subject’s wishes.
Freedom means that refusing consent will not have adverse consequences. Consent is not freely given particularly where one contracting party is “stronger”, such as an employer compared with an employee.
Specificity means that consent is given for a specific, defined processing purpose or purposes.
Being informed relates to the controller’s information obligation and publishing the information required by Articles 13 and 14 of the GDPR Regulation. The period for which consent is given must not be omitted.
An unambiguous indication of wishes means an active opt-in. The data subject must take an action to express the intention to give consent.
Final recommendations
Every employer and business processing personal data on the basis of consent must be able to prove that consent was given.
Before obtaining it, however, the controller must consider whether consent is genuinely the most appropriate legal basis for processing the data subject’s personal data. If consent is appropriate, the conditions for giving it must be respected.
When choosing the form of consent, remember that the form determines how clearly the consent can be demonstrated.
We will be happy to help you prepare GDPR documentation.
