Data Subject Consent

[AlvaroGDPR]

Dear all,

I'm having troubles interpreting Article 7, 3 related to the conditions of consent. The text says:

The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw consent as to give it
​

Then, I have several doubts:

1. How can I split the clauses of a general purpose contract the user signs to which he is withdrawing consent to a specific part ? Does it mean I have to sign a new contract which excludes the part he's opposed to now ?
2. In other words, does the user withdrawal of consent annuls the contract in any way ?
3. Currently I'm analyzing a consent form that includes this statement "I hereby definitely and irrevocably grant permission to", as well as the right to withdraw consent. I find it quite ambiguous. Is the wording valid after the GDPR introduction or should I suggest a change?

Thanks a lot

 

[Hitesh Mistry]

Hi

I would be very clear on the terms of service of your business and list everything that consent is required for if it doesn't fall under lawfulness of processing.

If a user withdraws their consent it needs to be clear on what they are withdrawing their consent from - it shouldn't annul the contract however it again depends on the reasons for processing.

In terms of the consent statement, be clear on what is is you are doing and what you require consent for. You may need to split items individually to acquire separate consent.

 

[Paul Carmen]

@AlvaroGDPR, we'd need more detail to help you, we have no context from your post. The GDPR clause you refer to refers to consent to use personal data, most generally for marketing or some other contact purpose. This would normally mean if you opt into marketing on a website, the user now has to be able to opt out easily under GDPR & you can then no longer use their data for marketing.

What sort of contract are you talking about? If its a legal/commercial contract of some sort it would not be subject to GDPR in the way you talk about & you'd not be using their data in a marketing way usually. They couldn't opt out of the contract in this way, as their data is needed for the contract to be in force.

If this is general consent or terms of use on a website (or you are passing data to any 3rd parties, you'd have to specify what & who you pass data to under GDPR), your clause is not GDPR compliant. You cannot sign people up in that way & it wouldn't be compliant in the UK now, as people can opt out marketing today, you can't sign them up forever in this way.

 

[AlvaroGDPR]

Hi Paul,

I'm mostly focused on assessing the maturity of HR and the employees rights within the company.

Specifically, the excerpt I quoted was from a photo/video release form from the department of branding for the employees of the company (for awareness campaigns, for example), in which the list of things the user grants permission to is long but the consent is captured once in the terms I mentioned.

 

[Paul Carmen]

It does not really sound contractual then. You'd probably be better to do it on a case by case basis; e.g each time photos/videos are created, as they might want to be in one thing & not another.

What if they decide they no longer want to consent to any of it, they will still be an employee & have to submit data for HR, payroll, training, running the business etc, they can't opt out of that. They would have the right to opt out of you using their image for marketing under GDPR though.

 

[AlvaroGDPR]

Thanks, Paul, it's way clearer now.