Consent as Basis for Processing Personal Data (Chapter 1, Section 7) — Guide to the GDPR

Consent is a valid legal basis for processing both ‘ordinary’ personal data (Article 6 GDPR) and special categories data (Article 9 GDPR).

Surprisingly, the wording of Article 10 GDPR suggests that consent would not be sufficient to process ‘criminal’ data as Article 10 GDPR on top of legal basis for processing from Article 6(1) GDPR requests either ‘control of official authority’ or specific ‘Union or Member State law’. We are not sure how deliberate is that limitation. In practice, however, processing ‘criminal’ data based on consent (or contract) should be allowed. Very prudent controllers intending to commence such processing could pre-inform their local Prosecution about their intentions, pointing to laws allowing for such activity. For example, they may refer to local regulations allowing to publish name and face of a suspect or convict based on their consent, as an argument that if consent justifies ‘public’ processing, then consent is enough for a ‘non-public’ processing as well.

According to Article 7 of GDPR:

According to the definition in Article 4(11) GDPR, consent of a data subject means:

freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

According to Recital 32 GDPR:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous. … [conditions for consent]

According to Recital 42 first sentence:

the controller should be able to demonstrate that the data subject has given consent to the processing operation. [principle of accountability]

According to Recital 42 fourth sentence:

For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. [informed consent] [layered approach]

From the definition given above as well as from the revised Guidelines on Consent adopted by the EDPB (Article 29 Working Party) on 10/04/2018 (17/EN WP259 rev.01), consent to be considered a valid basis for data processing, the following conditions apply:

Freely given. Consent is considered free if it is given freely and willingly by the data subject. ‘Freely given consent’ means that the person concerned has to have true freedom of choice. Consent of this kind cannot be given under pressure, and moreover, refusal to make the relevant statement or withdrawing consent cannot have adverse consequences for the data subject. Consent is not considered to be freely given if lack of consent results in negative consequences for the data subject. In this respect, we should concur with the views contained in the WP259 guidelines.

Another words consent is freely given if it depends on a free will of a data subject. Consent is not freely given if lack of consent results in adverse consequences to a data subject.

According to Article 7(4) GDPR quoted above, if ‘the performance of a contract, including the provision of a service, is conditional on consent to the processing that is not necessary for the performance of that contract’ then consent is not considered freely given. Two interesting conclusions stem from this provision. First, that bundling consent with contract is not allowed (we talk more about bundling below). Second, that a data controller should not mistake consent with contract as they are separate legal basis legitimising personal data processing.

Imbalance of power. If there is an imbalance of power between data subject and an institution, the consent is not deemed freely given.

Under Recital 43 GDPR:

In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller.

In case there is a clear imbalance of power between a data subject and a controller, a consent might not be considered freely given. When it comes to operations performed in relation to all employees, employers generally cannot rely on the consent.

Interestingly, the GDPR permits an employer to process an employee’s personal data on the basis of consent in cases defined in detailed provisions of law or collective bargaining agreements. This is stated in Recital 155.

Conditionality. In order for a consent to be considered freely given, it should not be conditional. While it happens fairly often, a consent should not be required if data are needed for the performance of a contract. This is a common mistake. Conclusion and performance of a contract are independent (Article 6, section 1, letter b of GDPR).

The distinction is blurred if a customer is offered add-on services which, should s/he wishes to take advantage of them, s/he needs to consent to (by sending a text message about an incoming email or a money transfer or using double authentication feature – customer needs to provide their mobile phone number so they need to agree that it is used). According to the EDPB (Article 29 Working Party), such ‘consents’ are deemed freely given and justifiably obtained. Contrary to the view of the EDPB, we see such actions as a mere entering into a contract for add-on services even.

(Dis)bundling/detailing. A consent is not considered to be freely given if it cannot be expressed separately for each type of (data processing) activity. The Article 29 Working Party uses the example of consent to an email communication combined with a consent to transfer of data to another company within the same group of companies. This example is misleading though because it mixes a consent for personal data with a consent for direct marketing communication (electronic communication consent). It ignores controller’s justified interest in direct marketing and transferring data. The problem lies in law which creates two parallel regimes – data protection regime and electronic communications regime with separate rules for consents (and, even more misleading, soon redirecting from e-communication to data protection when the e-Privacy Regulation is finally adopted). In practice, consents for different activities (processing data for different purposes) should be given on separate forms or by ticking individual checkboxes.

The price of no consent. If consent is bundled up as a non-negotiable part of terms and conditions of an agreement, it is presumed not to have been given freely. Should this happen, and in case of an audit, offering significant benefits in exchange for the consent will be subject to closer evaluation.

On the other hand, both the consent itself and the data acquired are a ‘commodity’ and may be paid for in various benefits. From this point of view, it is about the ‘unconditional aspect’ and ‘not bundling’ with any other benefits (bundling of nonrelated services is additionally banned under the EU consumer law).

The consent should be given independently and separately from any other ‘transaction’ between the data subject and the controller. It is not so much about the ‘maths’ as it is about economics and psychology. We are not in a situation of acting ‘freely’ when we apply for a bank loan, instead we are driven by a need. The data are being processed in order to enter into an agreement and not on the basis of a consent given.

Offering vouchers or other incentives in exchange for consent should be allowed. It should also be allowed to pay for the consent but preferably not in the form of an adjustment of price for the requested service. The problem lies in financial conditions more than in a legal structure.

For example, we are finding ourselves in an ‘economic need’ of borrowing money and the necessity to pay for it, but we do not want to overpay. This is why, in our opinion, in the context of GDPR, the idea of offering a lower interest rate in exchange for a consent takes the ‘free’ aspect away. Of course, we may say that instead of asking for a consent a bank may offer to their customers a contract for ‘acceptance of e-marketing’. This could, however, lead to circumventing GDPR and e-privacy regulations and as such be considered as unfair consumer practice.

Paid consent or a contract? Eventually if we were to be rigorous about principles of consent, a remunerated consent is not freely given as a non-consenting party loses an opportunity. Therefore, more broadly, a paid consent should rather be considered as a contract where a data subject allows for processing of their personal data in remuneration for a specific consideration. Such contract would in many cases be under scrutiny of consumer protection authorities as in many cases it would be bundled with a primary contract, and the question would be asked if a ‘consent contract’ is an independent contract or it is just a ‘primary contract’ bundled with an unrelated contract which is generally considered an abusive clause.

Under Article 7(3) GDPR the person can withdraw consent at any time. For many organisations, it will be a true challenge to introduce simple mechanisms to handle that procedure efficiently. This is crucial because it must be as easy to withdraw consent as it is to give consent. If, for example, consent is given by ticking a checkbox online, then it is not permitted to require that a data subject withdraw consent by sending notice to this effect in writing. Withdrawal of consent means that the controller is no longer able to process personal data on those grounds. Naturally, withdrawal of consent does not affect the lawfulness of processing operations performed up until that time.

The prerequisite that consent be given is also provided for in other acts of law, in particular a prior consent to use of automated communication (automated calling machines, fax, electronic mail) for direct marketing is required by Article 13 of the so-called e-Privacy Directive. The GDPR does not change anything in this respect.

However, we need to be aware that consent for digital direct marketing communication is often mistaken with consent for data processing, even by supervisory authorities. In result often two or three separate consents are being required. In reality, if a person consents to use a particular communication channel for direct marketing (text message, email, telephone, a particular internet communicator) then that person usually expects getting some sort of direct marketing messages through agreed channels. Therefore as you do not plan to market unexpected goods or services (e.g., offering cooking books to gamers) to those who consented to receive direct marketing messages from you, you may rely on legitimate interest (Article 6(1)f GDPR) instead of requiring a separate consent for data processing.

Finally, the burden of proof that consent has been given rests with the controller, and therefore as a fundamental rule consent must be documented.

According to Article 7(3) fourth sentence, consent has to be as easy to withdraw as it was to give. This right and process must be handled by the controller.

In practice, withdrawal should be available through the same communication channels which were available for the consent to be given. Controller’s systems and processes must make note of the consent withdrawal. In practice, where consent was given via electronic interface by filling in an online form, the same website should give an option of an easy retrieval, withdrawal or unclicking.

Most of the electronic services are built clearly against the easy withdrawal principle. Opt-out or terminate options are hidden as deep as possible. When consents are collected through any channel possible, withdrawal is often available only through call centre, emailing human operator and hoping it works, etc. Taking into consideration the privacy by design principle (Article 25(1) GDPR), imposing or staying with such practices after 25 May 2018 may and should result in severe administrative fines when reviewed by supervisory bodies.

According to Recital 32 fifth sentence GDPR:

If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

Based on the above Article 29 Working Party we believe that it is necessary to make sure that data subjects do not get ‘tired’ when clicking and reading, that they remain vigilant and do not simply, mechanically, without understanding continue to consent.

There are practical problems with the above righteous approach. One is that there are online guidelines how to make user consent and they are based on disturbing user enough to force her/him to take action. Second is that according to GDPR, consent should not be predefined (default option); therefore, consenting should by default be more exhausting than doing nothing (hence UX guidelines how to make ‘non-consent’ at least equally disturbing as consenting). Third, that the whole programmatic or ad-tech business model is based on multidirectional hundred partner traffic of data, which one could compare to a simultaneous intercourse between hundreds or thousands of those who the online advertising industry calls ‘trusted partners’. It is beyond human perception and performance to freely and in an informed manner agree to be a subject of a traffic for two or seven hundred ‘trusted partners’ at a time. And this is exactly what happens with our data when we enter popular internet portals. Our personal data are being trafficked to hundreds of third parties of which we know nothing, and we have no human ability to learn about. That is why the burden of responsibility for choosing partners for such interchange of our data should rely on our data controllers and not on us. That is, our consent is not a valid legal basis for such processing of our data, a legitimate interest of controllers based on a properly performed legitimate interest analysis (Article 1.f GDPR) could be.

Specific consent means consent that reasonably precisely defines the purpose for which data is processed. It is not possible to obtain abstract or blanket consents; for example, ‘I consent to personal data processing as provided for in the GDPR.’ Information related to consent must be distinctly separate from information concerning other issues, for example connected with a contract.

Specific consent corresponds to the principle of specific purpose of data processing. As the purpose should be specific, it should be formulated using specific wording. As usual with the GDPR the key word is ‘reasonably’. The requirement of precision of consent and the requirement that consent should be informed (as briefly explained below) contradicts the requirement of conciseness, transparency and intelligibility (Articles 5(1)a and 12(1) GDPR). To sort out of this contradiction, the EDPB came up with the concept of ‘layered’ information duty, which we describe below.

However, the requirement that consent should be specific should not result in demanding a data controller to know the future or the unknown. Therefore a consent should be goal/purpose oriented. According to Recital 32 fourth sentence, ‘Consent should cover all processing activities carried out for the same purpose or purposes.’ We should tell a data subject ‘what for’ we are going to use the data, but not necessarily describe ‘what we will do’ with the data (as long as they stay within the EU and no automated decision-making resulting in legal or similar effects is involved, see Articles 13.1.f & 14.1.f and 13.2.f & 14.1.g GDPR).

Informed consent means providing a data subject with vital information enabling an informed decision to be made so that the individual understands what they are consenting to. In this context, the clause itself also has to be worded in plain and simple language (principle of transparency contained in Article 5(1)(a) and expanded in Article 12(1) GDPR).

Informed consent follows from the principle of fairness (Article 5(1)(a) GDPR), which is the obligatory approach for a controller in their relationship with the data subject.

In order to determine that a consent is informed, a person (data subject) needs to know the consequences of such a consent in the context of their rights. This way we will fulfil the duty to inform as per Article 13 or 14 GDPR. If we request consent to use data which have already been in our possession, having previously fulfilled our duty to inform about it, we need to at least provide the missing information (listed in the WP259 guidelines on consent). The WP260 guidelines recommend however that the full set of information is requested again. Such an approach (requesting full set of information again) might be easier to process.

Transparency/Plain/intelligible language. Consent forms and other communications related to requesting and obtaining of consent should be clear and intelligible for data subject. Remarks referred to in the context of Article 12 GDPR – rights of the data subject – apply. The WP259 guidelines go as far as even recommending voluntary test panels. Such test panel could be recruited from staff or a group of friends (referred to in Article 12 GDPR).

Layered approach. According to Recital 42 fourth sentence:

For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended.

Based on the above minimum requirement for consent and taking into consideration the vast scope of information obligation contained in Articles 13 and 14 GDPR, the EDPB (Article 29 Working Party) proposed in their Guidelines on Consent, a so-called layered approach to consent and information obligations.

The layered approach means providing immediate essential information (who and for what) associated with a reference to a more detailed, complete explanation (most often a link to an internet place where an appropriate privacy policy resides). Though the Guidelines on consent refer to situations where it is needed ‘to accommo date for small screens or situations with restricted room for information’, the Guidelines on transparency (WP260 rev.01) refer to it more broadly. In practice the layered approach works best for any situations.

Lack of ambiguity is the last of the listed criteria and means that consent must be given unambiguously in the form of a statement or explicit action confirming consent, for example subscription to a newsletter and confirming this by clicking on an activation link sent in an email stating that an email address has been added to the database (double opt-in).

Consent has to be unambiguous and demonstrated with a clear action of data subject: signature, ticking a box by a mouse click, sending an email, responding to a text message or otherwise saying ‘I agree’, registering or clicking ‘I agree’ button. Article 29 Working Party even refers to turning a smartphone in a figure of eight.

Let us be realistic; a very popular e-commerce practice of requiring consent to be able to use an electronic service (a social media platform, a news portal, a mobile application) usually by no means meets the described above requirements for consent to be valid. Most of the time it is not freely given – if the use of the service depends on consent it is not a consent – it is more like consideration, so the user and the provider enter into a contract. Most of the time it is not informed – you are humanly unable to give an informed consent to a data controller for sharing your data with two or seven hundred so-called trusted partners. Neither it is specific. We are ignorant of what our data are used for, and if we were presented with the scope of use of our data, it would be too long and too complicated to read for most of the people.

Data controllers should consider using legitimate interest instead and to make it truly legitimate, they should perform and document the so-called legitimate interest analysis we are writing about above. At the same time, supervisory bodies should become more welcoming to legitimate interest though it requires a legitimate judgment call not only from controllers but also from supervisory bodies. Opportunistic reliance on consent undermines sustainability of the whole, still fragile system of data protection.

All of the above principles (freedom of granting, specificity, being informed, unambiguity, transparency, intelligibility) taken separately might seem reasonable and feasible. Unfortunately, when mixed together, they create an unattainable level of smart communication requiring telling everything in a few words. To make consent or consents specific, informed and unambiguous, you would have to provide detailed explanations of what specifically you are going to do with the data – i.e., what the data subject is consenting to. Add to it an information obligation from Articles 13 and 14 GDPR and you are ending up in a bureaucratic heaven or hell (pending from which perspective you look at it) ideal for regulators and big corporations but particularly hostile for micro, small and medium enterprises.

As we have mentioned above, the EDPB (Article 29 Working Party) tried to camouflage a little this immovable conflict in their Guidelines on Consent, where they proposed the so-called layered approach to consent and information obligations which we have already briefly described.

Theoretically consent can be given in any form, as the GDPR does not impose any rules directly in this respect. Though, the principle of accountability continues to apply, and thus consent can be given in any form, but the controller is required to prove that consent was given. For this reason, as a rule, consent must be documented.

This does not necessarily mean in writing, as the ticking of a checkbox, selection of technical settings, or a recording of a telephone call, for example, is sufficient. Let us remember that inaction on the part of a data subject, for example lack of response to an email requesting consent, even if it can be deemed to be silent consent (tacit acceptance), is not effective under the GDPR. Tacit acceptance does not meet the minimum unambiguity requirement, and it does not meet ‘affirmative action’ requirement.

Documenting that consent has been given does not always require recording a mere act of consenting. For example, a technical (e.g., IT) process may be designed in such a manner that you are not able to advance without confirming your consent. Yet, two issues arise. First, you need to relate a process to data, so you need to register either entering data to a system or consenting to use them. Second, you need to consider if a process conditioning certain actions on consent meets previously described criteria of validity of consent and in particular a requirement of freedom of consent.

According to Recital 32 GDPR, ‘consent should be given by a clear affirmative act’. EDPB in an interesting view which allows such act to be even waiving a mobile device. Authors of that view probably do not drink alcohol.

A situation in which a statement giving consent is part of a different statement is not permissible either. For example, a controller cannot effectively cite consent if it takes the form of acceptance of service terms and conditions in which a statement of that kind is one of the provisions. This will not meet the criterion of freely given consent.

‘Explicit consent’ is a category specified by GDPR for the purpose of consent for processing special categories of data, for automated decision-making and special data transfer outside the EEA. This relates to a more formalised consent than ‘regular’ though setting a difference taking into consideration the requirements for an ‘regular’ consent is not that easy.

Under Recital 32 GDPR:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her such as by a written statement, including by electronic means, or an oral statement.

This essentially means that each consent must be explicit because otherwise it is not unambiguous. Therefore ‘explicit consent’ in the meaning of GDPR should be understood in a more explicit way.

The logical explanation to this question is that a data subject should explicitly state they are consenting to processing their data when the FGDPR requests so. A formal question should be asked, e.g. ‘Do you consent to processing by us the XXX Bank data relating to your health you provided us with for the purpose of granting you loan repayment vacation or partial relieve based on our discretionary decision?’ (an example used to illustrate explicit consent in a chapter about special categories data). Answer to that question should be explicit and directly associated with the question (i.e., why at the elementary school we are requested to answer with the ‘whole sentence’).

Apart from requesting a full documented sentence ‘I agree to processing my health/sexual/political/etc. data/to automated processing my data for the purpose of/to transferring my data to your Dubai branch,’ Article 29 Working Party proposes a two-tiered consent (a consent with additional confirmation). It seems as though the consent not only has to meet all the basic requirements but also be given in a way that cannot be performed only mechanically (without thinking), for instance ‘yes, I agree for my medical records about my fractured arm to be sent to (X) Medical Clinic in the US’ – signature’ (which basically consumes the first possible method of obtaining an ‘explicit consent’).

Controller has to demonstrate that consent was given.

As we have mentioned in a precedent point, it is, therefore, necessary either to record consents and be able to find/reference them in a different way or to prove that a business or technical process is organised in such a manner that consent is a prerequisite for advancing. Recording consents seems to be quite an archiving task, particularly in relation to consents given orally. As a rule, it is unacceptable to call for witnesses to prove that consent was given, although it may be done under special circumstances (if consent was granted in emergency). Proving that a business process does not allow for circumventing a consent may be quite a challenge as well, especially against experienced supervisory bodies.

There is no time limitation for the consent validity. Article 29 Working Party recommends that consents are ‘refreshed’ at ‘appropriate intervals’, e.g. annually.

In our view, a controller should use their judgment to decide in what circumstances consent should be deemed ‘no longer valid’ and document it accordingly. If controller handles the right for consent withdrawal, there is no point in disrupting the privacy of data subjects with unnecessary communication.

In case a controller communicates periodically with data subjects based on consent, it may just add to each communicate a brief information about an option to withdraw consent. That seems least invasive.

If processing data based on consent by a controller does not require communicating with data subjects responding to a question if and how often to remind about the possibility to withdraw consent should depend on risk analysis. A controller should ask themselves a question what risk to rights and freedoms of data subjects such processing generates and based on an answer decide if and how often remind data subjects about their ability to withdraw consent and about potential adverse consequences of the consent remaining in place (has anybody ever done it?!).

Article 8 GDPR introduces additional rules on consent to the processing of personal data of a child of below 16 years of age when the child is offered information society services.

According to Article 8, section 1 GDPR, offering information society services directly to a child can be based on a consent of that child if they are at least 16 years old. Where the child is below the age of 16 such processing will be lawful on the basis of a consent given by their parent or legal guardian.

Information society services are services provided electronically, which in fact are access to various content and functionalities online or thanks to online enablers/‘platforms’ – websites, applications, even tangible things such as cars, etc. – not necessarily for a charge, especially as very often (and practically in every case)

payment in the digital word takes the form of provision of information. This relates in particular to popular social networking sites on which people can post text, photographs, and films, or a combination of these forms.

As we point out when discussing right for information, the Article 29 Working Party Guidelines on Transparency (WP260 rev. 01) stipulate that the responsibility to adapt communication for children rests not only on the controllers who target children but also on those who should be aware that their products and services are used particularly by children (e.g., social media for posting short video messages which disappear after viewing, etc). The same guidelines suggest the possibility of using the language and rhetoric of the United Nations (UN) Convention on the Rights of the Child. In the WP259 guidelines on Consent, the Article 29 Working Party lays out Article 8 GDPR in a narrower way, referring to the controller’s intention (that they do not address their website to children, because the content is ‘adult’, because the controller does not intend to derive profits from children). Though the same guidelines wrongly refer to the age limit of 18 (instead of 16 as stated in Article 8(1) GDPR) which may suggest that whoever wrote it had either not familiarised themselves with Article 8 GDPR or had only skim-read it.

To protect children against the consequences of posting their personal data online (not even necessarily when this is done irrationally), the GDPR requires the consent of a child’s legal guardians to the child’s use of electronic services offered to the child (e.g., setting up an account on a popular social networking site and then posting photos and film clips for fun). Under Article 8(2) GDPR, this means an obligation for a controller to take reasonable measures to determine whether the guardian has given consent. As a minimum, this requires certain mechanisms to verify the age of a guardian but also probably the relationship to the child who wishes to make use of specific services.

The issue of a consent of a child’s guardian to use of an internet site is not new. Certain international corporations that offer services to children have introduced systems to solve the problem. Systems of this kind are also known in the ‘adults only’ industry – as a general rule they require identification using a credit card; that is, an instrument rarely made available to minors. Even the largest social networking sites balance on the edge of the law and officially offer their services to adults or persons aged over 13, for example in the US (Children’s Online Privacy Protection Act), relying on waivers of liability.

The offering by a website of services to a child directly does not mean, despite appearances, that it is a store with toys or software for children. This term should be interpreted broadly, to include situations in which the controller is aware that the products it offers are attractive to children as well, which it attracts as users of the service.

What are the reasonable steps that need to be taken to ensure that the guardian has given consent? The GDPR does not provide an answer to this interesting question, to ensure technological neutrality. This is a difficult question and may depend on the type of e-service offered. Even the issue of identification of a user of electronic services is a sensitive subject by itself. It seems that age verification requires either identification or prediction (based on a kind of test or artificial intelligence). It is possible to imagine a situation in which a controller introduces user age profiling mechanisms that are based on a user’s behaviour on the site or in which it profiles a user’s age according to data that it collects in any case (i.e., without collecting additional data). In such a case, it can identify minors and require them to produce proof of their age or consent from their guardian. Any parent knows that at a popular video streaming service age verification mechanisms and content control tools for parents are fiction.

Finally, it only needs to be said that the argument that once a child reaches their majority for personal data purposes their consent to processing of their data posted in the past will have to be obtained again is not practically reasonable. For this reason we will not be addressing this issue. If it transpires that the supervisory authority wishes to examine this aspect, we will conduct a more thorough analysis or update our assessment.

#7.1 Consent: Most Important GDPR Quotations

#7.2 Conditions for Consent

#7.2.1 Freely Given Consent

#7.2.1.1 Withdrawing Consent

#7.2.1.2 Easy Withdrawal

#7.2.1.3 Click Fatigue

#7.2.2 Consent Which Is Specific

#7.2.3 Informed Consent

#7.2.4 Unambiguous Consent

#7.2.5 ‘Internet Consent’

#7.3 Conflict of Principles

#7.4 Form of Consent

#7.4.1 Explicit Consent

#7.5 Accountability

#7.6 Retention (Consent Validity Period)

#7.7 Child’s Consent to Information Society Services (Social Media, Electronic Services, Etc)