Source: https://gdpr-info.eu/issues/consent/
Timestamp: 2019-01-19 22:20:12
Document Index: 795487065

Matched Legal Cases: ['Art. 4', 'Art. 6', 'Art. 7', 'Art. 8', 'Art. 9', 'Art. 22', 'Art. 49']

The basic requirements for the effectiveness of a valid legal consent are defined in Article 7 and specified further in recital 32 of the GDPR. Consent must be freely given, specific, informed and unambiguous. In order to obtain freely given consent, it must be given on a voluntary basis. The element “free” implies a real choice by the data subject. Any element of inappropriate pressure or influence which could affect the outcome of that choice renders the consent invalid. In doing so, the legal text takes a certain imbalance between the controller and the data subject into consideration. For example, in an employer-employee relationship: The employee may worry that his refusal to consent may have severe negative consequences on his employment relationship, thus consent can only be a lawful basis for processing in a few exceptional circumstances. In addition, a so-called “coupling prohibition” or “prohibition of coupling or tying” applies. Thus, the performance of a contract may not be made dependent upon the consent to process further personal data, which is not needed for the performance of that contract.
As one can see consent is not a silver bullet when it comes to the processing of personal data. Especially considering that the European data protection authorities have made it clear “that if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.” Strictly interpreted, this means the controller is not allowed to switch from the legal basis consent to legitimate interest once the data subject withdraws his consent. This applies even if a valid legitimate interest existed initially. Therefore, consent should always be chosen as a last option for processing personal data.
Art. 4 GDPR Definitions Art. 6 GDPR Lawfulness of processing Art. 7 GDPR Conditions for consent Art. 8 GDPR Conditions applicable to child's consent in relation to information society services Art. 9 GDPR Processing of special categories of personal data Art. 22 GDPR Automated individual decision-making, including profiling Art. 49 GDPR Derogations for specific situations
(32) Conditions for consent (33) Consent to certain areas of scientific research (38) Special protection of children's personal data (40) Lawfulness of data processing (42) Burden of proof and requirements for consent (43) Freely given consent (50) Further processing of personal data (51) Protecting sensitive personal data (54) Processing of sensitive data in public health sector (71) Profiling (111) Exceptions for certain cases of international transfers (155) Processing in the employment context (161) Consenting to the participation in clinical trials (171) Repeal of Directive 95/46/EC and transitional provisions
European Commission ► Grounds for Processing (Link)
European Commission ► When is consent valid? (Link)
EU publications ► Handbook on European data protection law – Consent, page 111 (Link)
Lukas Zolejnik ► How to: GDPR, consent and data processing (Link)
IAPP ► The UX Guide to getting consent (Link)
Tilburg University ► Consent now and then (Link)
CIPL ► GDPR Implementation In Respect of Children’s Data and Consent (Link)
Oxford University Press ► Commentary on the EU General Data Protection Regulation (GDPR) – Lawfulness of processing, Page 32 (Link)