On 2 March 2017, the UK Information Commissioner’s Office (“ICO”) published detailed draft guidance on consent under the GDPR and has submitted it for public consultation. This is the ICO’s first piece of specific GDPR guidance published further to its overview of the GDPR published last January.
The guidance sets out the ICO’s interpretation of the new requirements to obtain valid consent under the GDPR including its view of the role of consent in the GDPR, the benefits of getting consent right and the penalties for getting it wrong. The guidance also explains: (i) when consent is required or appropriate (or not) and the alternative to consent; (ii) what constitutes valid consent under the GDPR with specific guidance on children’s consent and consent for research purposes; (iii) advice on how to obtain, record and manage consent; and (iv) a consent checklist.
The public consultation on this draft guidance will be open to responses until 31 March 2017 with the view to publishing final guidance on consent in May 2017.
Other European Data Protection Authorities have published or are currently carrying out public consultations on guidance on consent under the GDPR:
- The French Data Protection Authority (“CNIL”) is currently consulting on, amongst other things, the form of consent, practical difficulties relating to evidencing consent and withdrawal of consent. The public consultation will be open until 24 March 2014. The CNIL’s consultation paper is available here.
- The Irish government consulted on the issue of children’s consent under the GDPR during Q4 of 2016. The consultation paper is available here, although the Irish government has not yet published a response to the consultation.
- The Bavarian DPA (the “BayLDA”) published a short paper on consent on 24 October 2016, summarising the differences between the existing German law on consent and the GDPR in addition to issues surrounding the collection of consent.
- The Düsseldorfer Kreis, a working group of German DPAs, issued a statement relating to consent under the GDPR on 27 September 2016. In particular, this focused on the preservation of validity of consent under the GDPR. The Düsseldorfer Kreis also issued a working paper on consent in June 2016 providing practical recommendations for adoption of the GDPR.