General Data Protection Regulation (GDPR) #ThinkData Guidance Note 5 Consent The GDPR introduces a higher standard for consent. The key elements are the same as the Data Protection Act, but adds the indication must be “unambiguous” and given “by a statement or by a clear affirmative action”. In other words, a positive opt-in – consent cannot be inferred from silence, pre-ticked boxes or inactivity. Generally there are more rights for the individual when you rely on consent to process personal data. Note, consent as a basis for processing should not be confused with consent for marketing purposes. Where consent is used, it must be “freely given, specific, informed and an unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.” As outlined in the Guidance Note – lawfulness of procesing, there are 6 grounds / conditions for processing, of which consent is one. Consent should only be used when there is not another basis for processing. Where it involves special category data, there must also be a condition for processing from Article 9. This is normally via consent unless one of the other conditions apply. Their effect is to permit the processing of sensitive personal data for a range of other purposes – typically those that are substantially in the public interest, and which must necessarily be carried out without the explicit consent of the individual. Examples include preventing or detecting crime and protecting the public against malpractice or maladministration. A full list of the additional conditions for processing is set out on the legislation.gov website: The Data Protection (Processing of Sensitive Personal Data) Order 2000. Consent is not appropriate for data processing if you cannot offer customers a genuine choice over how you use their data. Consent will likely be used by Council in very limited circumstances e.g. If consent were refused, you would process the data on a different basis. Seeking consent would therefore be unfair and misleading as you are giving the individual the illusion of having a choice If consent is requested as a precondition of accessing services, it may not be considered valid consent, as it is not freely given If you are in a position of power over the individual – those who depend on you or your services may not give free and valid consent due to their fear of adverse consequences
General Data Protection Regulation (GDPR) #ThinkData Guidance Note 5 Consent The GDPR introduces a higher standard for consent. The key elements are the same as the Data Protection Act, but adds the indication must be “unambiguous” and given “by a statement or by a clear affirmative action”. In other words, a positive opt-in – consent cannot be inferred from silence, pre-ticked boxes or inactivity. Generally there are more rights for the individual when you rely on consent to process personal data. Note, consent as a basis for processing should not be confused with consent for marketing purposes. Where consent is used, it must be “freely given, specific, informed and an unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.” As outlined in the Guidance Note – lawfulness of procesing, there are 6 grounds / conditions for processing, of which consent is one. Consent should only be used when there is not another basis for processing. Where it involves special category data, there must also be a condition for processing from Article 9. This is normally via consent unless one of the other conditions apply. Their effect is to permit the processing of sensitive personal data for a range of other purposes – typically those that are substantially in the public interest, and which must necessarily be carried out without the explicit consent of the individual. Examples include preventing or detecting crime and protecting the public against malpractice or maladministration. A full list of the additional conditions for processing is set out on the legislation.gov website: The Data Protection (Processing of Sensitive Personal Data) Order 2000. Consent is not appropriate for data processing if you cannot offer customers a genuine choice over how you use their data. Consent will likely be used by Council in very limited circumstances e.g. If consent were refused, you would process the data on a different basis. Seeking consent would therefore be unfair and misleading as you are giving the individual the illusion of having a choice If consent is requested as a precondition of accessing services, it may not be considered valid consent, as it is not freely given If you are in a position of power over the individual – those who depend on you or your services may not give free and valid consent due to their fear of adverse consequences
GDPR%20Guidance%20Note%205%20Consent(1).docx