March 6, 2017

The new guidance concerns consent in the GDPR and the ICO is interested to gain feedback on it through a short consultation that runs until 31 March 2017.

The ICO reminds readers that the basic concept of consent, and its main role as one lawful basis (or condition) for processing, is not new. However, the GDPR sets a high standard for consent. It builds on the Data Protection Act 1998’s standard of consent in a number of areas and it contains significantly more detail on both the standard and processes for consent.

The ICO’s guidance on consent explains its recommended approach to compliance and what counts as valid consent. It provides practical help to decide when to rely on consent, and when to look at alternatives. It also explains the key differences with the DPA and gives advice about existing DPA consents.

Following the consultation, the ICO says that it aims to publish the final guidance in May 2017. This timescale may be affected, it says, if it needs to take account of developments at the European level.

That will not be the end of the ICO’s work on consent. Later in the year it is planning to issue a call for evidence to get a better sense of what technical solutions are available or are being developed for obtaining and managing consent. It is also working with its European counterparts in the Article 29 Data Protection Working Party to produce further agreed guidelines on consent later this year. To access the guidance and for further information on how to respond to the consultation, click here.