recent work

Council of the European Union proposes to relax data protection consent

The Council of the European Union published a report on 31st May setting out suggested compromises to the draft Data Protection Regulation which is set to change and harmonise data protection law across Europe toughening up the UK’s data protection laws from next year. The report follows around 3,000 proposed amendments to the draft Regulation being suggested by the member states.
One of the suggestions is to change the consent required to undertake direct marketing from “Explicit” to “Unambiguous”. The direct marketing industry will no doubt regard this as something of hollow progress as they see the introduction of explicit consent as something of a death knell. Speaking in Leeds in March 2013 the Direct Marketing Association’s Director of Public Affairs, Caroline Roberts, told the audience that the new Data Protection Regulation would kill off trading and sharing data and unsolicited direct marketing due to the requirement in the Regulation to have obtained prior explicit consent.

So, what would constitute “Unambiguous Consent” and how would it differ from “Explicit Consent”?

Unambiguous consent feels very close to implied consent i.e. consent through not opting out, and it seems to follow that provided there are sufficient well worded and clear notices provided to individuals when collecting their personal information, by not opting out, the individual could well be deemed to be granting consent for the organisation collecting their personal information to use it for direct marketing purposes. That unambiguous consent has been obtained fairly and lawfully.
Explicit consent suggests that the whole area of implied consent is simply not robust enough: that consent will not be valid unless an individual has ticked a box themselves in the full knowledge that in doing so, their personal information will be used for particular purposes, and additionally, that they are free to do so with no undue pressure being exerted by the organisation. This latter point is interesting and usually explained in the context of an employment situation where an employer holds more power in the data processing relationship than the employee and that an employee saying, “actually I don’t want to grant my consent to my personal information being sent to China for payroll processing purposes”, is likely to be pressurised to conform.

But in the context of a commercial relationship what do consumers do when faced with a no option such as “grant consent or don’t use our services”? My guess is that most simply tick the consent box. The big question is whether this will be permissible when the new Regulation becomes law next year and whether consumers would have valid grounds for complaint with large multi national companies in these circumstances.

http://www.statewatch.org/news/2013/jun/eu-council-dp-reg-10227-add1-13.pdf

Tags: , , , , ,