Key Dates
Guidance issued by the ICO on 9 May 2018.
Guidance adopted by the Article 29 Working Party on 10 April 2018.
Summary
The Information Commissioner's Office (ICO) has issued guidance on consent as a lawful basis for processing personal data under the General Data Protection Regulation (GDPR). The guidance follows revised guidelines on consent adopted by the European Article 29 Working Party on 10 April 2018.
Points to note from the ICO guidance include the following.
- Where consent is relied on as the lawful basis for processing personal data, the controller must clearly tell the individual what it will do with the consent and whether it does any other processing on a different lawful basis. If the controller knows that it will need to retain the data after consent is withdrawn for a particular purpose under another lawful basis, the individual must be told this from the start.
- Individuals who are asked to consent to processing personal data must be given the name of the controller and of any third party controllers who will be relying on the consent.
- Previous consents under the Data Protection Act 1998 do not need to be refreshed if they already meet the standards required under GDPR.
- Where special category data is being processed, there must be both a lawful basis for the processing under Article 6 and one of the lawful conditions under Article 9 must be met. "Explicit consent" may be relied on as the lawful condition for the processing of special category data under Article 9, even where a different lawful basis for processing under Article 6 is used.
Date Accessed: 28/05/2022