Consent for Data Processing: GDPR Requirements and Common Mistakes
How to properly collect and document consent for personal data processing? Consent validity requirements and how to meet them.
Consent is one of six legal bases for data processing under GDPR - but also the riskiest. Improperly collected consent is invalid, meaning no processing basis and fine risk. Here are requirements and common mistakes when collecting consent.
What requirements must consent meet under GDPR?
Consent must be (Art. 4(11), Art. 7): freely given - no pressure, service not conditional on consent, specific - for defined purposes, unambiguous - expressed through clear affirmative action (opt-in, not opt-out), informed - after receiving full processing information. For special category data, "explicit" consent is required.
What are common consent collection mistakes?
Typical mistakes: pre-checked checkboxes (not allowed), bundled consent - consent for multiple purposes at once, consent hidden in terms, no information about withdrawal right, making service conditional on consent (when consent isnt necessary), lack of consent documentation. Each mistake can invalidate consent.
How to document and manage consent?
Controller must be able to demonstrate consent was given. Documentation should include: consent clause content, date and method of consent, person identification, privacy policy version. Consent management platform (CMP) should enable: collecting, storing, withdrawing consent. Withdrawal must be as easy as giving consent.
When NOT to use consent as processing basis?
Consent is not appropriate when: processing is necessary for contract performance, there is power imbalance (employer-employee), person has no real choice, consent withdrawal would be problematic. In such cases, other bases are better: contract performance, legitimate interest, legal obligation.
Wizards.io solutions support consent requirements compliance. **Revelio** identifies data processed on various legal bases. **Oblivio** automates data deletion upon consent withdrawal, ensuring persons right is fulfilled.
Consent is a powerful tool but requires precision. Consent collection mistakes can invalidate all processing operations. Consider alternative legal bases.