Under the DPA, personal data cannot be processed unless at least one of the ‘conditions’ set out in Schedules 2 and 3 is met. One of these is that the individual whom the personal data is about has consented to the processing.
As the ICO says:
“There is a fundamental difference between telling a person how you’re going to use their personal information and getting their consent. It is important to make sure that where people do have a choice, they are given a genuine opportunity to exercise it. This means that it must be freely given, specific and fully informed”.
CONSENT UNDER THE GDPR
The definition of consent in Article 4 of the GDPR is:
“Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”
This means that the subject has to do something to consent. If there was any doubt that this means that the subject has to do something to consent, Recital 32 says:
“Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent.”
In other words, under the GDPR, opt-out consent will not be an option – only an opt-in will do.
NB: The above article does not take not consideration (1) requirements under the PECR; nor (2) any additional steps that should be taken to obtain consent from children aged under 16.
This article is intended for informational purposes only and should not be relied upon as legal advice.
While you’re here, why not take out DP Test?
To contact DataHelp email email@example.com or call 07902 395989