The sometimes vexed question as to what exactly constitutes valid consent under EU data protection law has recently been clarified by the EU Data Protection Commissioners’ grouping, known as the Article 29 Working Party. Consent is one of the several legal grounds for processing personal data.

The Working Party has advised that in order for consent to be valid it must be:

• Freely given, specific, informed and unambiguous
• Given, by indication, before the processing of data begins

In addition, companies must abide by the principles of proportionality when dealing with data.

The opinion analyses what is meant by the terms ‘freely given’, ‘specific’, ‘informed’ and ‘unambiguous’, and provides some examples of valid and invalid consent. It also includes helpful suggestions for dealing with the issues of obtaining consent from children and others lacking legal capacity.

Contributed by David Cullen, John Magee & Brian McElligot.

Back to Legal News