The EU Data Protection Commissioners’grouping called the Article 29 Working Party (the “Working Party”) hasgiven an opinion on the sometimes vexed question as to what exactlyconstitutes valid consent under EU data protection laws.

The Working Party advised, that in order for consent to be valid itmust be freely given, specific, informed and unambiguous. Consent is oneof several legal grounds for processing personal data.  Where consentis the basis to be relied upon, it must be given, by indication, before the processing of data begins.

In addition, companies must abide by the principles ofproportionality when dealing with data. This means that many companiesmay have to review their procedures to ensure information provided inorder to obtain consent is adequate and that mechanisms are in place toverify that valid consent was given. This is expected to result in thegreater use of dialogue boxes and tick boxes among online companies butthe options must not be pre-selected.

Essential Criteria:

• Freely Given – Consent is given freely where there is no risk of deception or significant negative consequences for failing to give consent
• Specific Consent – this is obtained where the exact purpose for processing the data is clearly communicated. Blanket consent, without specifying the exact purpose of process, is not acceptable
• Informed – In order for consent to be informed, all necessary information in relation to the scope and purpose of the processing of the data must be directly communicated to the data subject in a clear manner, e.g. by the use of dialogue boxes in an online context
• No Ambiguity – In order to avoid ambiguity, the individual must give consent by some form of indication i.e. there must be some positive act, such as ticking a box. Default internet browsing settings or pre- ticked boxes are not adequate methods to obtain valid consent

The following rules must also be observed for consent to be valid:

• Timing – Consent must be obtained before the processing of data begins
• Accountability – Even where a company has obtained valid consent, the principles of fairness, necessity, proportionality and quality must be observed e.g. data can only be retained and used for the purpose(s) it has been received

There are also helpful suggestions for dealing with the issues ofobtaining consent from children and others lacking legal capacity.

Contributed by David Cullen.