Mar 72017

ICO Publishes Draft Guidance on Consent Under the GDPR and Submit it to Public Consultation

William RM Long and Geraldine Scali
, , ,

On 2 March 2017, the UK Information Commissioner’s Office (“ICO”) published detailed draft guidance on consent under the GDPR and has submitted it for public consultation. This is the ICO’s first piece of specific GDPR guidance published further to its overview of the GDPR published last January.

The guidance sets out the ICO’s interpretation of the new requirements to obtain valid consent under the GDPR including its view of the role of consent in the GDPR, the benefits of getting consent right and the penalties for getting it wrong. The guidance also explains: (i) when consent is required or appropriate (or not) and the alternative to consent; (ii) what constitutes valid consent under the GDPR with specific guidance on children’s consent and consent for research purposes; (iii) advice on how to obtain, record and manage consent; and (iv) a consent checklist.

The public consultation on this draft guidance will be open to responses until 31 March 2017 with the view to publishing final guidance on consent in May 2017.

Other European Data Protection Authorities have published or are currently carrying out public consultations on guidance on consent under the GDPR:

  • The French Data Protection Authority (“CNIL”) is currently consulting on, amongst other things, the form of consent, practical difficulties relating to evidencing consent and withdrawal of consent. The public consultation will be open until 24 March 2014. The CNIL’s consultation paper is available here.
  • The Irish government consulted on the issue of children’s consent under the GDPR during Q4 of 2016. The consultation paper is available here, although the Irish government has not yet published a response to the consultation.
  • The Bavarian DPA (the “BayLDA”) published a short paper on consent on 24 October 2016, summarising the differences between the existing German law on consent and the GDPR in addition to issues surrounding the collection of consent.
  • The Düsseldorfer Kreis, a working group of German DPAs, issued a statement relating to consent under the GDPR on 27 September 2016. In particular, this focused on the preservation of validity of consent under the GDPR. The Düsseldorfer Kreis also issued a working paper on consent in June 2016 providing practical recommendations for adoption of the GDPR.

The ICO’s draft guidance is available here, and the consultation document is available here.

William RM Long

London

wlong@sidley.com

Geraldine Scali

gscali@sidley.com

You might also like
UK’s New Pro-innovation Approach to Regulating Digital Technologies

On 15 March 2023, the UK Government published, alongside its Spring Budget, a report on the Pro-innovation Regulation of Technologies Review (the “Report”). The Report was led by the government’s Chief Scientific Advisor and National Technology Officer, Sir Patrick Vallance, who was tasked with “bringing together the best minds to advise how the UK can better regulate emerging technologies, enabling their rapid and safe introduction.” In response, the UK Government has accepted all of the Report’s recommendations, and set out some next steps for their implementation.

Substantial Changes to Hong Kong’s Privacy Laws Coming

In a briefing to the Legislative Council (Hong Kong’s legislative body) on February 20, 2023, the Privacy Commissioner (“the Commissioner”) announced that substantive amendments to the Personal Data (Privacy) Ordinance (“PDPO”) will take place.

It Is Now More Difficult For International Pharma To Transfer Data Out Of China

China’s new Measures for the Security Assessment of Outbound Data Transfers (the “Measures”) came into force on September 1, 2022. Pharma companies now have until February 28 to work out whether their activities mean they are affected, and to apply for the new type of data security assessment if they need it.