Consent is your agreement, which in most cases must be obtained in order to process your personal data. The law permits the processing of personal data without one’s consent in exceptional cases only.

Principles of consent

There are three essential aspects regarding your consent: 

  • it has to be given freely, namely, without any pressure
  • it has to be specific and unambiguous, indicating those specific purposes and personal data categories which you allow to process
  • you have to be informed which data will be used, how and for what purposes

example Your silence or inactivity cannot be considered a consent.

Your data can be processed for only those concrete, specific purposes and in the concrete, specific manner with which you have agreed.

Withdrawal of consent

As consent is given freely, you are also free to withdraw your consent. For example, in situations where you learn or suspect that your data is being used for different purposes than those to which you initially agreed.

Requirement

Your consent is usually required before an authority or a private individual or entity can start processing your personal data.

example If you want to become a customer of a bank, you agree to give your identity data, including your passport copy, to a bank for the purpose of identifying you and to authenticate your financial activities.

Exceptions

There are some exceptions when your consent is not required. All of these exceptions are regulated by law and you can read more about them in the General Data Protection Regulation.

example If criminal proceedings have been commenced against you, the police and the prosecution will collect information from other institutions and use things like your identity code, address, etc., without requiring your consent to do that.

Limiting requests for data

Unfortunately, private entities and public authorities commonly request data which is not strictly needed for fulfilling their duties and activities. This may have been done on purpose, for example, to collect data about you for marketing or other commercial activities.

There are situations in which you are obliged to provide certain data, or in which you will simply be refused a service if you are not willing to provide it. However, you should generally feel free to be critical and ask that the data be limited or negotiate to provide only the minimum where you believe the request is excessive or possibly against the law.

example It would be an excessive requirement to provide your passport copy, containing your image, citizenship, identity code and passport number – sensitive data not needed for identification in the shopping process, to become a client of a shopping center.

Unlawful use & Suspension

If someone uses your personal data and you have not given your consent to such action, you should check whether this is an exceptional situation stipulated in the General Data Protection Regulation. If not, this person is acting in an unlawful manner and you have the right to request the suspension of your data processing.

Resources

Last updated 25/03/2022