Glossary term
Consent
Subject: Technology, Cyber and Data, Data Protection and Privacy
Also known as: Data subject consent
In data protection, consent is a person's genuine choice, made knowingly and for a named purpose, to allow an organisation to use their personal data.
Explanation
Valid consent has to pass several tests. The person needs a real choice, so it cannot be the price of a service that works without the data. It covers one purpose at a time, follows a clear notice, and needs an obvious act: pre-ticked boxes and silence do not count. People must be able to withdraw it as easily as they gave it. Organisations keep records showing who agreed, when and to what. Consent is only one legal basis for processing. Where another basis fits better, such as a contract or a legal duty, asking for consent can mislead people into thinking they have a choice they do not. It also differs from informed consent in medicine or from agreeing to terms and conditions. Consent that fails these tests leaves the processing without a lawful footing, whatever the box says.
Example
A fitness app asks users to tick a box agreeing to share their health data with advertisers. The box is pre-ticked and the app will not run without it. A regulator would likely find this consent invalid. The app redesigns the screen with a separate, unticked option for marketing sharing and a settings page to withdraw it.
Not to be confused with
- Informed Consent (Clinical)
- Agreement to medical treatment or research. Data protection consent concerns the use of personal data, though both require understanding and freedom of choice.