You only have the right to process (ordinary) personal data if you can rely on 1 of the 6 bases from the General Data Protection Regulation (AVG). One of those bases is that someone has given permission to process his or her personal data.
The AVG contains a number of requirements that consent must meet. Does the consent not meet these requirements? Then the consent is not valid. You may then not process the personal data.
Consent requirements
Legal consent meets the following requirements:
Freely given
You may not pressure someone to give consent. For example, by disadvantaging someone if he or she does not give consent. Pay attention to power relationships here: for example, an employee may find it difficult to refuse a request from his or her employer.
Unambiguous
There must be a clear active action. For example, a (digital) written or oral statement. In any case, it must be absolutely clear that consent has been given. You may not use the principle 'silence means consent'. The use of pre-ticked boxes is therefore not permitted.
Informed
You must inform people in advance about:
the identity of you as an organization;
The purpose of any processing for which you are seeking consent;
What personal data you collect and use;
the right they have to withdraw consent again.
You must provide the information before seeking consent in an accessible format. It must also be understandable so a person can make an informed choice. That means you must use clear and simple language.
Specific
Consent should always apply to a specific processing and purpose. Do you have multiple purposes for processing data? If so, you must inform the data subject about this and request consent for each purpose separately. The purpose may not change over time.
Requesting permission
The AVG does not prescribe the exact form in which you must seek consent. So it is up to you How you ask for consent. As long as you can prove that you have actually received consent.
Consent in children
The AVG gives extra protection to children under the age of 16. Because children are not able to assess the risks of a data processing operation or are less able to do so. Therefore, they must have permission from one of their parents or guardians.
Revoke consent
People have the right to withdraw their consent. That should be as easy as giving consent. So make sure people can easily withdraw their consent.
For example, what is not allowed: people can give consent online with one click or swipe, but must call customer service or send a letter if they want to withdraw their consent.
Accountability
Do you want to rely on the basis of consent? Then make sure that you can prove that you have properly asked for and received that consent. Under the AVG, you have an accountability obligation.
Learn more about consent
More information on consent under the AVG can be found in the Consent Guidelines from the European privacy regulators.
