Is informed con­sent in the dig­i­tal age appropriate?

Con­sent was draft­ed in the GDPR as a legal panacea for data pro­cess­ing where no oth­er statu­to­ry legal grounds exist. How­ev­er, there are data con­trollers / com­pa­nies that have estab­lished con­sent as one of their major – if not only – legal grounds. Is that prudent?

In her Duet Inter­view with the well-respect­ed expert on data pro­tec­tion, Prof. Dr Hel­frich, Dr Cal­daro­la, author of Big Data and Law, con­sid­ers whether con­sent is a suit­able instru­ment for fre­quent use in dig­i­tal busi­ness models.

Con­sent needs to be eas­i­ly under­stood, trans­par­ent and infor­ma­tive in order for an indi­vid­ual to legal­ly con­sent to the pro­cess­ing of his/her data. Most of the time, com­pa­nies pro­vide a lengthy and exten­sive form or text of some sort that customers/data sub­jects mere­ly skim through or scroll down to con­tin­ue with their activ­i­ties on the inter­net. Is this an appro­pri­ate inter­pre­ta­tion of a con­sent and does it ful­fil the intent of the leg­is­la­tor? Or are com­pa­nies delib­er­ate­ly tak­ing advan­tage of a poten­tial cus­tomer’s desire to ful­fil his/her orig­i­nal pur­pose online as quick­ly as pos­si­ble with­out being both­ered with exten­sive con­sent and infor­ma­tion texts, with the result that most cus­tomers just scroll though and click “yes” with­out giv­ing the mat­ter any fur­ther thought or consideration?

Prof. Dr Mar­cus Hel­frich: In my opin­ion, we should be tak­ing the con­cept of “informed con­sent” which forms the basis of pro­cess­ing of per­son­al data under Art. 6 para 1 lit. a GDPR (Gen­er­al Data Pro­tec­tion Reg­u­la­tion) more seri­ous­ly than has pre­vi­ous­ly been the case. Our demo­c­ra­t­ic and lib­er­al soci­ety is based on a very fun­da­men­tal under­stand­ing of a per­son being born free and able to iden­ti­fy him/herself as well as being capa­ble of lead­ing a life ground­ed in self-deter­mi­na­tion. Not only are our social and our polit­i­cal sys­tems based on this under­stand­ing, which philo­soph­i­cal­ly is formed by the ideas of enlight­en­ment, and, espe­cial­ly, by the influ­en­tial thoughts of Immanuel Kant, but, indeed, our very legal sys­tem reflects this under­stand­ing. For this rea­son, it is incum­bent upon us to take the notion of an informed con­sent very seri­ous­ly. The legal rela­tion­ships between indi­vid­u­als are based on trust and deci­sions which have been made by choice.

My favorite quote is:

 

“Sapere aude! Have the courage to use your mind with­out some­one else’s guidance.”

Immanuel Kant, 1784

Of course, I rec­og­nize that com­pet­i­tive mar­ket behav­iour, which is char­ac­ter­ized by rival com­pa­nies and the strug­gle to obtain cus­tomer or prod­uct sales, has made com­pa­nies sus­cep­ti­ble and will­ing to influ­ence the cus­tomers’ minds and deci­sions in as effec­tive a man­ner as pos­si­ble, includ­ing the use of psy­cho­log­i­cal arti­fices. But, in the end, the basic legal con­di­tion remains that a per­son­’s deci­sion must be based on it hav­ing been made inten­tion­al­ly and ratio­nal­ly. Such a deci­sion is only pos­si­ble if the indi­vid­ual is at least aware of all the rel­e­vant aspects that might be impor­tant. If we do not accept this pro­vi­so, we as a polit­i­cal soci­ety have to bid farewell to the con­cepts of free will and self-deter­mi­na­tion. The road to a non-demo­c­ra­t­ic autoc­ra­cy in the hands of the most influ­en­tial enter­pris­es or inter­est groups would then lie open.

As you might imag­ine, the ques­tion of how we deal with the con­cept of con­sent with­in a con­text of pro­tect­ing pri­va­cy leads direct­ly to the ques­tion of our under­stand­ing of democ­ra­cy, jus­tice and polit­i­cal participation.

In short, there is no alter­na­tive, in my opin­ion, to a con­cept of “informed con­sent”. First of all, it is the role and duty of a state to set up rules to pro­tect and enforce this notion. Sec­ond­ly, every­body has to make his or her own deci­sions regard­ing this impor­tant issue which trans­lates into exer­cis­ing our fun­da­men­tal right to self-deter­mi­na­tion. The con­cept of “informed con­sent” includes, there­fore, a need for con­scious action on the part of the cus­tomer. If he or she acts with­out hav­ing edu­cat­ed him­self or her­self on this mat­ter and has thus decid­ed with­out hav­ing giv­en any real thought to the issue, then we can­not speak of delib­er­ate con­sent in this sit­u­a­tion. But this might only describe a sin­gle instance and is not fun­da­men­tal­ly dif­fer­ent to the prin­ci­ple of informed con­sent. As Immanuel Kant stat­ed, we have to use our minds to act and live-in self-determination.

There are statu­to­ry legal grounds allow­ing for data pro­cess­ing and con­sent as a legal panacea, if no statu­to­ry grounds are avail­able. Which cas­es can resort to con­sent as the only way to achieve a company’s pur­pose and which cas­es have a vari­ety of legal grounds at their disposal?

To put it sim­ply, if no legal grounds can be found under Art. 6 para 1 lit. b to f, then con­sent remains the only legal option to pro­cess­ing per­son­al data. This hav­ing been said, we have to keep in mind that the rela­tion between the dif­fer­ent legal grounds for pro­cess­ing per­son­al data under arti­cle 6 is com­pli­cat­ed. On the one hand, all of these grounds might act as a legal foun­da­tion for pro­cess­ing. On the oth­er hand, you are not enti­tled to base your pro­cess­ing on the legal grounds list­ed in Art. 6 para 1 lit. b to f, if you asked for con­sent as per Art. 6 para 1 lit a, and the con­sent was refused by the per­son in ques­tion. Fur­ther­more, request­ing con­sent might be seen as not act­ing in good faith if the rel­e­vant pro­cess­ing is a legal require­ment (e.g. tax law) because not pro­cess­ing the data is sim­ply not an option.

An indi­vid­ual can with­draw his or her con­sent at any time, mean­ing that a data con­troller must stop using the respec­tive per­son­al data and erase the data from its IT sys­tems. Log­i­cal­ly, this with­draw­al requires con­sent man­age­ment. Is it advis­able for a com­pa­ny to base its busi­ness on the con­sent of an indi­vid­ual – espe­cial­ly in the cas­es of Indus­try 4.0 or Big Data where lengthy man­u­fac­tur­ing / analy­ses times are involved? What alter­na­tives are avail­able and why should they be employed? Why do com­pa­nies often resort to con­sent as if it were their only option?

A rec­om­men­da­tion to process data legal­ly which is sole­ly based on the con­sent of an indi­vid­ual is sim­ple and, in its sim­plic­i­ty, wrong.

A com­pa­ny has to con­sid­er care­ful­ly which legal ground for pro­cess­ing under arti­cle 6 is most suit­able. Only after that legal analy­sis has been com­plet­ed, is the com­pa­ny able to iden­ti­fy sit­u­a­tions where it is advis­able to ask for consent.

Today, our leg­is­la­tors in Europe are seri­ous­ly con­sid­er­ing under which cir­cum­stances com­pa­nies should be allowed to process per­son­al data only if explic­it con­sent has been giv­en. These sit­u­a­tions seem to be char­ac­ter­ized by a sig­nif­i­cant risk that indi­vid­u­als, such as cus­tomers, might be mis­led, insuf­fi­cient­ly informed, or be put in a sit­u­a­tion requir­ing a high­er amount of pro­tec­tion by the law. The use of cook­ies for mar­ket­ing pur­pos­es (tar­get­ed mar­ket­ing) or for pre­dic­tive ana­lyt­ics might be a good exam­ple of these types of scenarios.

I doubt that any sci­en­tif­i­cal­ly reli­able research has been done on the ques­tion of how often com­pa­nies resort to oth­er legal grounds instead of con­sent for legit­i­mate pro­cess­ing of per­son­al data. For this rea­son, I am not able to spec­u­late on why alter­na­tives to con­sent are not used to process data.

Con­sent requires active man­age­ment of per­mis­sion being grant­ed and with­drawn. In addi­tion, sim­ply solic­it­ing con­sent forces users to click more often and thus extends the dura­tion of their online activ­i­ty which, in turn, car­ries the risk that indi­vid­u­als might quick­ly lose inter­est and stop their pur­chas­ing plans – as we have learned in an ear­li­er inter­view with Petra Dahm. Is con­sent real­ly effective?

Yes, con­sent is pro­mo­tion­al. Exer­cis­ing your right to free will and self-deter­mi­na­tion requires effort. If self-deter­mi­na­tion is not being prac­ticed owing to one or two clicks, this would prove that our polit­i­cal devel­op­ment since the 18^th cen­tu­ry has only pro­gressed in terms of technology.

Com­pa­nies often draft con­sent not only because they require it. They fre­quent­ly use con­sent to include oth­er data pro­cess­ing activ­i­ties. Most of the time, an indi­vid­ual isn’t giv­en the oppor­tu­ni­ty to grant a par­tial con­sent in order to pur­sue the activ­i­ty which had orig­i­nal­ly been planned. Are com­pa­nies using con­sent to become a data vac­u­um clean­er? Are com­pa­nies mis­us­ing the legal grounds of this last resort to legit­i­mate data pro­cess­ing and does this mean that con­sent is turn­ing into a tool to suck up even more data?

In my expe­ri­ence, these types of behav­iour on the part of com­pa­nies very often occur owing to mis­in­for­ma­tion and a lack of knowl­edge of how data pro­cess­ing might be done law­ful­ly. The lim­i­ta­tion to a defined pur­pose is one of the fun­da­men­tal prin­ci­ples of data pro­tec­tion law. I doubt it is pos­si­ble to iden­ti­fy com­pa­nies delib­er­ate­ly mis­us­ing the intend­ed legal panacea as a gen­er­al problem.

Of course, there are com­pa­nies who wil­ful­ly go beyond what they are legal­ly allowed to do and gath­er addi­tion­al data. In such cas­es, the super­vi­so­ry author­i­ties are asked to inves­ti­gate these sit­u­a­tions and to react by apply­ing sig­nif­i­cant puni­tive fines. In con­crete terms, we have seen that, since 2018, there is a devel­op­ment towards sanc­tion­ing these crim­i­nal acts.

In order for a con­sent to be legit­i­mate, it must be pre­cise and yet com­pre­hen­si­ble for data sub­jects. For legal advi­sors, it seems very dif­fi­cult to draft such a con­sent that ful­fils all legal require­ments. Many con­sents that have been reviewed by the courts were judged not to have been legit­i­mate. Is con­sent a good choice for secure legal grounds of a dig­i­tal busi­ness model?

If a request for con­sent is made, after a com­pa­ny had analysed the neces­si­ty for con­sent based on the rules of Art. 6, then it is indeed a pru­dent choice to ensure the secure legal grounds of dig­i­tal business.

The prob­lem is that legal advi­sors them­selves must analyse these sit­u­a­tions in a nuanced fash­ion, and their con­clu­sions must be based on skilled busi­ness exper­tise. We real­ly need spe­cial­ists who are famil­iar not only with the legal require­ments of the dif­fer­ent leg­isla­tive acts gov­ern­ing pri­va­cy laws, they must also know how busi­ness process­es are defined and which busi­ness needs are based on the pro­cess­ing of per­son­al data. Ful­fill­ing all of these require­ments means that pri­va­cy law and prop­er legal advice con­cern­ing it have become chal­leng­ing activ­i­ties for consultants.

Giv­en the fact that dig­i­tal busi­ness mod­els are very com­plex, an indi­vid­ual can hard­ly be expect­ed to have a real overview of the impli­ca­tions of the con­sent in ques­tion. With this in mind, do you think that an indi­vid­ual is tru­ly able to pro­vide his or her con­sent? In oth­er words, is con­sent an appro­pri­ate legal basis? Would it have been wis­er if the leg­is­la­tor had pro­vid­ed a pre­cise list of data pro­cess­ing aims to give indi­vid­u­als and com­pa­nies a legal­ly water­tight and reli­able framework?

Yes, I strong­ly believe in the capac­i­ty of peo­ple to under­stand what is impor­tant to them. This includes the fact that one can ask if some­thing is dubi­ous or not trust­wor­thy. In the end, one has to decide for one­self if one is will­ing to take the risk of being sub­ject to one’s per­son­al data being processed, if the grounds for such pro­cess­ing have not been explained prop­er­ly. This free­dom to take risks is also part of the idea of hav­ing the right of self-deter­mi­na­tion and act­ing upon it. As a lib­er­al soci­ety we have to accept such a deci­sion as well.

Dig­i­tal busi­ness mod­els are very intri­cate, and the pro­cess­ing of data is hard­ly com­pre­hen­si­ble for most con­sumers. Com­plex­i­ty can usu­al­ly only be reduced through trust. Is it, there­fore, not the respon­si­bil­i­ty of spe­cial­ists, such as data pro­tec­tion author­i­ties, data pro­tec­tion offi­cers, infor­ma­tion secu­ri­ty offi­cers, data pro­tec­tion leg­is­la­tors and oth­ers, who under­stand the com­plex­i­ty in its entire­ty due to their insights and pro­fes­sion, to act as a guar­an­tor for legit­i­mate, bal­anced, hon­est and fair data processing?

Yes, I agree com­plete­ly with that sen­ti­ment. Exper­tise is not only a pro­fes­sion­al qual­i­fi­ca­tion. It cor­re­sponds with an under­stand­ing of accept­ing the duties and respon­si­bil­i­ties which come with being an expert in that spe­cif­ic domain. There­fore, the expert in ques­tion should play an active role with­in the process of devel­op­ing trans­paren­cy and trust, espe­cial­ly if dig­i­tal tech­nol­o­gy is con­cerned and per­son­al data is being processed. In my opin­ion, there is a need to explain not only how data pro­cess­ing func­tions, but also to show which pos­i­tive effects might be asso­ci­at­ed with the use of data pro­cess­ing. A gen­er­al and broad­er social con­sent should become a pre­req­ui­site of the broad­er use of infor­ma­tion tech­nol­o­gy and data pro­cess­ing with­in a demo­c­ra­t­ic soci­ety. Data pro­cess­ing not only has pos­i­tive effects on the econ­o­my. It has an impor­tant impact on soci­ety and affects our under­stand­ing of polit­i­cal par­tic­i­pa­tion, deci­sion-mak­ing process­es and, in the end, how we view indi­vid­ual free­dom and human rights. Experts play an impor­tant role in how we ratio­nal­ly acquire knowl­edge con­cern­ing infor­ma­tion tech­nol­o­gy and data pro­cess­ing. Prop­er infor­ma­tion with­in a ratio­nal frame­work is the key to avoid­ing “alter­na­tive facts” and to cre­at­ing trust in legit­i­mate processes.

The GDPR has been in force since May 2018, and com­pa­nies and data sub­jects have expe­ri­enced quite a few dif­fer­ent sce­nar­ios due to the fact that data pro­tec­tion and infor­ma­tion secu­ri­ty have come into the spot­light. Do you antic­i­pate the next legal amend­ment to revise the instru­ment of consent?

It is hard to spec­u­late about future legal devel­op­ments. But I do not think that the con­cept of con­sent will dis­ap­pear. As I explained ear­li­er, express­ing your con­sent is to be seen as one of the most impor­tant capa­bil­i­ties and rights of a self-deter­min­ing indi­vid­ual. Per­haps the con­cept of con­sent will reflect future tech­no­log­i­cal devel­op­ments. The core idea of con­sent, name­ly that an indi­vid­ual has to make a deci­sion while gath­er­ing all the nec­es­sary infor­ma­tion and eval­u­at­ing them using a val­ue- based approach to reach a ratio­nal con­clu­sion, will not change.

The statute of e‑privacy is intend­ed to come into force quite soon. Drafts have already revealed that con­sent is to be com­posed in a much more dif­fer­en­ti­at­ed way in this statute. Can you, first of all, briefly explain what might be expect­ed with regard to con­sent, and, sec­ond­ly, whether the way it has been draft­ed indi­cates that this thorny sub­ject will be han­dled bet­ter, and, final­ly, whether it is like­ly that the way con­sent is treat­ed in the e‑privacy statute may be a mod­el for the next revi­sion of the GDPR?

Giv­en that the draft is still under dis­cus­sion, it is impos­si­ble to spec­u­late or to dis­cuss aspects which could improve or cor­rect the pro­cess­ing of per­son­al data under e‑privacy at this time. The GDPR defines the basis for legit­i­mate pro­cess­ing of per­son­al data. Per­haps the upcom­ing e‑privacy reg­u­la­tion might improve the require­ments for law­ful pro­cess­ing. If the require­ments are not expand­ed upon or improved in some way, then we must revert back to the base­line found in the GDPR.

Prof. Hel­frich, thank you so much for shar­ing your opin­ion, your thoughts and your view on con­sent, its impor­tance and its han­dling in dai­ly life

Thank you, Dr Cal­daro­la, and I look for­ward to read­ing your upcom­ing inter­views with rec­og­nized experts, delv­ing even deep­er into this fas­ci­nat­ing topic.