The new EU Data Protection Regulation redefines consent of individuals. No longer, will it be sufficient for consents to be “freely given, specific and informed”. The new rules will also require consent to be “explicit” and evidenced by “a statement or by a clear affirmative action”. The evidential point simply reflects current regulatory guidance. We know, after all, that “silence is not consent”. However the inclusion of the word “explicit” has much greater ramifications.
Bear in mind also that the new definition of “consent” will have to interoperate with the e-Privacy rules under Directive 2002/58/EC. These rules include requirements for prior consent for e-marketing and (as we all know) consent for cookies. So, suddenly those marketing and cookie consents must also be explicit in order to be valid. Just as we thought we were moving away from consent as a sensible basis for legitimising the processing of data, we seem to be moving closer to it.