Update: GDPR consent revisited

As the GDPR implementation countdown clock heads forward to the deadline of 25. May 2018, we still encounter many questions about the concept of consent under the GDPR.

In addition to my earlier post 'Consent under the GDPR: check your processes!', the following insights in working with client GDPR implementations I would like to share.

• The GDPR defines consent as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.” This is a lower standard than the “explicit” consent required for the sensitive categories of data.
• But while “freely given” and “unambiguous” are familiar terms from the Data Protection Directive, the requirement of “specific” consent adds a new hurdle for companies to comply with the GDPR, and is certainly higher than the standard to which companies in other countries may be accustomed. That is, companies now cannot use one statement of consent from an individual as a blanket statement to allow all sorts of processing of data collected: rather, consent must be sought for each type of processing, for each purpose for which the company seeks to use the data.
• Consent must now also be active. That is, companies can no longer rely on silence, inaction, or pre-checked boxes. In addition, statements of consent cannot be “bundled” with other statements (such as when the individual is agreeing to the company’s terms of use). As a result, companies can no longer, for example, simply post a link to their privacy policy on their website and expect this to suffice: they must require users to actively accept the terms under which the company will be using their personal data. Companies will have to review and update their current opt-in procedures. Overall, obtaining effective consent from individuals under the GDPR will require more process (re)design than before.