Regulation and data
Consent
Consent is a voluntary, specific, informed and unambiguous indication of a person's wishes by which they agree, through a statement or a clear affirmative action, to the processing of their data (art. 4.11 of the GDPR). It is one of the six legal bases, and the only one the data subject can withdraw at any time.
Also known asdata subject's consent · informed consent · consentimiento
When it is valid and when it is not
The conditions are in art. 7 of the GDPR and art. 6 of Spain's LOPDGDD. The centre has to be able to show it was given (art. 7.1), and if it asks for it for several purposes, it has to be recorded specifically for each one (art. 6.2 of the LOPDGDD). It also has to be:
- Separate from everything else. If it sits in a document that covers other matters, such as the accommodation contract, it is presented apart and in plain language (art. 7.2).
- Active. Silence, pre-ticked boxes or inactivity are not consent (recital 32).
- Unconditional. The place cannot depend on consenting to processing the contract does not need (art. 7.4 of the GDPR and art. 6.3 of the LOPDGDD).
- Reversible. Withdrawing it has to be as easy as giving it, and what was processed before remains lawful (art. 7.3).
- Explicit when it concerns health data or other special categories (art. 9.2.a).
Worth knowing
Under fourteen, the minor's own consent is not enough. In Spain it is given by whoever holds parental authority or guardianship (art. 7 of the LOPDGDD), as explained under children's data. Where there is a clear imbalance between the one asking and the one consenting, recital 43 warns that it should not be the basis. And when asking for it is unnecessary, because the basis is another one, is covered under legal basis.
Sources
Related terms
- Legal basis for processingThe legal basis, or lawful basis, is what makes it lawful to process personal data. Art. 6.1 of the GDPR allows six: consent, contract, legal obligation, vital interests, a public-interest task or official authority, and legitimate interest. Without one of them, processing is unlawful however useful it is.
- Health dataData concerning health are those revealing a person's physical or mental health status (art. 4.15 of the GDPR). They are a special category: art. 9 prohibits processing them unless one of the exceptions in its paragraph 2 applies. In a residence, the everyday case is the dining hall's allergies and intolerances.