On 13 July 2011 the Article 29 Working Party issued an opinion on the concept of consent in the Data Protection Directive (the “Privacy Directive”) and in the e-Privacy Directive. The opinion is issued in response to a request from the European Commission as part of the ongoing review of the Privacy Directive. It provides a thorough analysis of the key elements of the definition of consent and clarifies the various aspects of the legal framework to ensure an easier application and understanding of the concept for all stakeholders involved.
Consent of a data subject is one of the six grounds which allows for legitimate processing of personal data. Consent, if adequately given, allows the data subject to fully control the processing of his personal data. However, the Article 29 Working Party notes that consent data does not provide a controller with a carte blanche to process the data, and the controller will still have to comply with all other requirements of the Privacy Directive.
The Privacy Directive defines consent as “any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.” In addition, consent has to be “unambiguous” and “explicit” for special categories of data. For each of these elements, the opinion provides numerous examples of valid and invalid consent. In addition, the Working Party provides that, in an online context, consent can never be validly based on an individual’s lack of action or silence. Moreover, the Working Party specifies when consent is considered to be valid if the data subject is underage or lacks legal capacity.
In light of the European Commission’s request, the opinion also contains some recommendations for the review of the Privacy Directive. As such, the Article 29 Working Party recommends to:
- clarify the meaning of “unambiguous” consent and explain that only consent based on statements or actions to signify agreement can constitute valid consent;
- require data controllers to put in place mechanisms to prove consent (in the context of a general accountability obligation);
- include an explicit requirement regarding the quality and accessibility of the information on which consent is based. (LCE and CLI)
The full text of the opinion of the WP 29 can be found on its website: http://ec.europa.eu/justice/policies/ privacy/docs/wpdocs/2011/wp187_en.pdf