Consent
Definition
A freely given, specific, informed and unambiguous indication of the data subject's wishes, by a statement or clear affirmative action, agreeing to the processing of their personal data.
Consent is one lawful basis among several, valid only when it meets demanding conditions. Under the GDPR (Art. 4(11) and Art. 7) it must be freely given, specific to each purpose, informed, unambiguous and given by a clear affirmative act; pre-ticked boxes and silence do not count. The controller must be able to prove consent was obtained, and withdrawing it must be as easy as giving it. Explicit consent is a stricter form used for special categories and some automated decisions.
The LGPD (Art. 5, XII and Art. 8) requires consent to be free, informed, unambiguous and for determined purposes; generic authorisations are void, and for sensitive data consent must be specific and highlighted.
Consent is fragile where there is an imbalance of power, as between employer and employee, or when a service is made conditional on agreeing to unrelated processing. If a user consents to a chatbot storing conversations to answer questions, that consent does not extend to using the transcripts to train a new model.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 1: Data protection foundations.
Also covered in: Responsible AI Practitioner (RAIP)
Primary sources
- GDPR Art. 4(11) and Art. 7
- LGPD Art. 5, XII and Art. 8
- EDPB Guidelines 05/2020 on consent