‘Explicit Consent’ in the Context of Personal Data Protection

What Constitutes “Explicit Consent” and How Is It Obtained?

Explicit consent denotes the voluntary consent furnished by the data subject or upon request from the other party for the processing of his/her personal data.

The acquisition of explicit consent may be executed through diverse channels, such as written documentation, electronic methods, or communication through call centers, among others.

Irrespective of the chosen method, the burden of proof falls on the data controller.

“Explicit Consent” necessitates a clear and specific subject matter.

Explicit consent is collected in relation to a particular subject. The validity of consent is contingent upon its lucidity and absence of ambiguity.

In scenarios where consent is sought to legitimize the processing of multiple sets of personal data, each consent must align with distinct aspects of processing such as the type of data and purpose of processing.

Furthermore, the data controller bears the responsibility to collect explicit consent for secondary uses of data (such as transfer of data abroad).

“Explicit Consent” necessitates a foundation of information.

The data subject must be thoroughly notified regarding the nature of data to be processed, as well as the ramifications of consenting to such processing operations. Prior to granting consent, the data subject must receive comprehensive notification thereof. Expressions conveying this information must be clear and comprehensive, avoiding the use of small font sizes to ensure readability.

“Explicit Consent” must be declared by free will.

Under specific circumstances harboring inequalities, such as the relationship between employer and employee, where the employee may lack genuine option to refuse consent or where refusal may lead to adverse consequences from the employer, it is impermissible to acknowledge that the consent is based on free will.

Acquisition of explicit consent should not be put forth as a requirement for accessing or utilizing a product or service. For instance, should use of service be contingent upon subscription, it would be unlawful to mandate collection and processing of fingerprints from any individual seeking to become a subscriber as a condition for the establishment of the subscription agreement.