On 13 July 2011, the Article 29 Working Party (the "Working Party"), the independent European advisory body on data protection and privacy, adopted an opinion on the definition of consent (WP 187) (the "Opinion"). The Opinion explains the notion of consent on the basis of a detailed analysis of the key elements of the definition of consent in EU Directive 95/46/EC (the "Data Protection Directive") and also briefly discusses how consent is used under EU Directive 2002/58/EC (the "ePrivacy Directive"). In addition, the Opinion contains a number of recommendations for the ongoing review of the Data Protection Directive.
The Opinion notes that there are different approaches and divergent views of good practice in different Member States and wishes to clarify matters to ensure a common understanding of the existing legal framework.
The Opinion recognises that there is an overlap between the notion of consent under the Data Protection Directive and the interpretation of consent in other fields of law, particularly contract law. Accordingly, national civil law requirements may also be relevant when assessing the validity of consent under the Data Protection Directive.
Consent constitutes one of the possible legal grounds for the lawful processing of personal data under the Data Protection Directive (Articles 7(a) and 8.2 (a) of the Data Protection Directive). Consent is not always the primary or the most desirable legal basis and in some cases may even be a weak basis. The Opinion therefore stresses that the use of consent in the right context is crucial. Moreover, the Opinion underlines that when a data controller relies on consent as a ground for processing data, this does not exempt the data controller from its other obligations under the Data Protection Directive.
Definition of consent
The Opinion explains the notion of consent on the basis of an analysis of its four key elements. Consent is defined in Article 2 lit. (h) of the Data Protection Directive as follows: "the data subject's consent shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed".
The first element is "any [...] indication of his wishes [...] signifying [...]". According to the Opinion, this implies a need for action. In other words, passive behaviour or simple inaction is insufficient.
Moreover, consent must be "freely given". The data subject must have a...