Point of law
Consent that holds
Consent is one of six legal bases and the only one that can lapse at any time. Where contract or legitimate interests apply, consent makes the processing revocable without need. Where consent is right, what decides is granularity, freedom of choice and the ability to withdraw as easily as to give.
A checkbox without a subject
On the screen sits a form with a checkbox and a sentence saying that the person agrees to the processing of their data. Which processing is meant is not stated. The form is a registration for a training course, and without the box it does not proceed.
Consent is the weakest of the six legal bases
Whether consent is the right basis for a purpose at all is rarely asked. Art. 6(1) GDPR sets out six conditions of equal rank, and consent is the first of them rather than the most distinguished. It is also the only one that can lapse at any time under Art. 7(3) GDPR.
The order of the assessment
Is the processing necessary?
For the contract, for a legal obligation, for a task in the public interest. Art. 6(1)(b), (c) or (e) GDPR then applies and consent becomes unnecessary.
Do legitimate interests prevail?
Art. 6(1)(f) GDPR requires a balancing exercise and its documentation. It costs work and yields a basis that cannot be withdrawn.
Only then consent
It is right where the processing is not necessary and no overriding interest exists, so for marketing, photographs and disclosure to third parties without a purpose of your own.
3 von 3
Unnecessary consent usually becomes a problem only once it is withdrawn. The processing cannot then be based on the contract retrospectively, since a different legal basis was stated to the data subject.
Consent or legitimate interests
| Consent | Merkmal | Legitimate interests |
|---|---|---|
| Declaration and recordForm, log, administration of the individual states. | Effort beforehand | Documented balancingWritten once, then updated only when something changes. |
| Revocable at any timeArt. 7(3) GDPR, without reasons and without notice. | Durability | Objection possibleArt. 21 GDPR requires grounds, except for direct marketing. |
| One state per personThat state has to reach every system in which processing takes place. | Effort afterwards | One rule for allDeviations only where an objection was raised. |
| Marketing, photos, disclosureEverything that cannot be justified without the person willing it. | Suited to | Security, operations, analysisEverything that serves your own operation and barely burdens the person. |
Consent is not the safe route but the more laborious one with the weaker footing. It belongs where the processing could not be justified without the person willing it.
One checkbox for several purposes is not consent
The Court of Justice of the European Union addressed the question whether a single consent can cover several processing purposes at once in its judgment of 1 October 2019. The indication of wishes must relate expressly to the processing in question. Consent cannot be derived from a declaration concerning a different matter. Entry into a prize draw therefore did not amount to consent to the setting of cookies.
Four requirements from Art. 4(11) GDPR
Freely given
Under Art. 7(4) GDPR the freedom of choice behind a consent may be in doubt where it is tied to a contract although it is not necessary for the performance of that contract. Disadvantages threatened in the event of a refusal likewise count against freedom of choice.
Specific
One decision per purpose. Newsletter, disclosure to partners and publication of a photograph are three purposes and need three boxes. A combined box bundles what the data subject would have to decide separately.
Informed
Before the declaration come the controller, the purpose, the recipients and the right of withdrawal. Art. 13(2)(c) GDPR requires the notice about withdrawal expressly before consent is given.
Unambiguous
A pre-ticked box does not suffice. Recital 32 GDPR expressly rules out silence, pre-ticked boxes and inactivity. What is required is a clear affirmative action.
Withdrawal has to be as easy as giving consent
What validly given consent later founders on is usually withdrawal. Art. 7(3) sentence 4 GDPR requires the same ease. Where giving consent is one click and withdrawing it is an email to a general address, the requirement is not met.
The state also has to reach the place where processing happens. A withdrawal that takes effect in the newsletter system and not in the customer database has not been implemented.
Three cases demand more than the general form
Whether the general requirements suffice turns on the kind of data and on the person. Three cases raise the threshold.
Additional requirements
Liste zu erledigender Punkte
- Special categories. Art. 9(2)(a) GDPR requires explicit consent for one or more specified purposes, so more than a clear affirmative action
- Minors. For information society services, Art. 8 GDPR requires the consent of the holder of parental responsibility below the age of sixteen, and reasonable efforts to verify it
- Employees. Section 26(2) BDSG requires text form as well as information about the purpose and the right of withdrawal, and treats consent as freely given in particular where a legal or economic advantage is obtained
How we support you with consent forms
An inventory should start from the record of processing activities. It documents the relevant legal basis for each processing activity. Where the record lists consent as a legal basis, that shows directly which declarations of consent have to be reviewed. At the same time it shows in which procedures and systems a withdrawal has to be given effect.
The competition-law side of marketing contact lies outside data protection law. Section 7(2) no. 2 UWG requires prior express consent for marketing by electronic mail, and that is a different assessment from the one under Art. 6(1)(a) GDPR. That assessment, the design of the exemption in section 7(3) UWG and the defence against a cease-and-desist letter run through the affiliated law firm.
Frequently asked questions
When is consent the wrong choice?
Wherever another condition of Art. 6(1) GDPR applies. Consent makes the processing revocable, and after a withdrawal the legal basis cannot be switched retrospectively to contract or legitimate interests.
May a service depend on consent?
Only in so far as the processing is necessary for the service. Art. 7(4) GDPR requires utmost account to be taken of such conditionality when assessing freedom of choice. A prize draw that makes entry conditional on marketing consent is the case the Court of Justice decided.
How is consent demonstrated?
Art. 7(1) GDPR places the burden on the controller. What has to be recorded is the wording of the declaration, the time and the manner of confirmation. Without the wording it cannot later be shown what was consented to.
Is a pre-ticked box enough?
No. The Court of Justice held on 1 October 2019 that a pre-ticked checkbox does not produce valid consent, and recital 32 GDPR expressly rules out silence, pre-ticked boxes and inactivity.
More questions from this area
Record of processing activities
The difficulty with a record of processing activities usually lies not in creating it for the first time but in keeping it up to date.
Information duties
The duty to inform arises with the collection of personal data and does not presuppose a contractual relationship.
Retention and erasure
Erasure duties do not depend on a request for erasure.
Get in touch!
Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!
Contact usAlternatively you can request a call back.