Organizations that leverage consent as a legal basis for data processing have to undergo many challenges to ensure that all valid consent elements are fulfilled.
Universal Consent Management enables organizations to capture consent and automate revocation fulfillment in a simplified and automatic manner.
Maintaining an accurate audit trail of valid consent is becoming increasingly important, specifically within marketing departments. Under the GDPR, consent is one of six legal grounds that marketers can rely on to process personal data, and for consent to be valid it must be:
Freely given
Specific
Informed and unambiguous
Given with a clear affirmative action
Why is Universal Consent Management needed?
Under most global privacy laws, personal data can be processed only if there is a lawful basis to do so. The data subject’s consent is one of the lawful basis of personal data processing. In some circumstances, the data subject’s consent may be the only lawful basis of personal data processing.
If an organization relies on the data subject’s consent for personal data processing. In that case, it must demonstrate that the processing is taking place only once the data subject has consented to such processing.
Consent as a lawful basis for data processing is not limited to using personal data for advertising and marketing purposes. Instead, it is essential wherever the possibility of identifying the individual exists. Organizations must obtain the data subject’s consent if it is possible to single out an individual, link records relating to an individual, or infer any information concerning an individual.
Universal Consent Management under GDPR and e-Privacy Directive
The GDPR and e-Privacy Directive are based on opt-in consent regimes, requiring consent to be freely given, specific, informed, and unambiguous indication of the data subject’s wishes.
Data subjects also have the right to withdraw their consent at any time. It is important to note that consent withdrawal shouldn’t affect the lawfulness of data processing. Once an individual opts out from the organization’s marketing communications, the organization must not send them any further marketing communications nor invite them to opt back into marketing.
Organizations must obtain the explicit consent of the data subject for the processing of special categories of data. These categories include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a natural person’s sex life sexual orientation.
In the digital context, the organization may obtain explicit consent in the form of an electronic signature, an email, an uploaded scanned document, or any other similar mechanism to ensure the data subject’s express and explicit consent.
Organizations must be careful while processing employees’ personal data based on their consent. In most cases, employees do not have genuine freedom to consent due to an unequal balance of power in an employer-employee relationship. Therefore, consent should effectively be a measure of last resort for an employer to turn to.
Universal Consent Management under CPRA
Two types of consent may be required under the CPRA regulations: express and implied consent. Express consent is when an individual explicitly agrees, in writing, to disclose their personal information. Implied consent is when an individual’s actions indicate that they are aware that their personal information may be disclosed and take no steps to prevent it.
For example, if an individual provides their name and contact information to a state agency to receive a service, they have given their implied consent to disclose that information to any third party who requests it, unless they have specifically requested that their information remain confidential.
The GDPR and CPRA differ concerning implied consent versus opt-in consent: The GDPR doesn’t recognize implied consent. This means that a pre-checked box would be considered implied consent under European data privacy laws. On the other hand, the CPRA is an opt-in law. However, the law does anticipate specific use cases where opt-out would be implemented instead of opt-in. Keep in mind that users always have the option of opting out of anything collected about them — even if they previously opted into it.
The following are sample use cases where opt-out consent applies:
Automated decision-making (Profiling)
Cross-Context Behavioral Advertising (Targeted Advertising)
Processing of Personal Data
Processing of Personal Data of Minors
Sale or Sharing of Personal Information
Use of Sensitive Data
The following are sample use cases where opt-in consent applies:
Sale or Sharing of Personal Information of Minors (Note that If you are selling or sharing the personal information of minors, you need the consent of their parent or guardian.)
Secondary or Additional Use of Data
Re-Opt-In for Sale After Previously Opting-Out
Participation in Financial Incentive Programs