GDPR consent must be obtained in order to process personal data in the European Union. It is one of the legal requirements for companies and organisations to process users’ data. The key principles of GDPR consent are that it must be:
- Free: Consent must be given voluntarily, without coercion.
- Specific: It must be clear and refer to the specific purposes for which the data will be used.
- Informed: The data subject must be fully informed about what their data will be used for and who will process it.
- Unambiguous and explicit: Consent requires a clear statement or affirmative act (such as ticking a box).
Breaches of GDPR consent requirements can lead to significant fines, so it is crucial to ensure that any use of personal data is compliant. This has applications in many sectors, for example:
GDPR consent in online marketing
The online marketing sector is probably one of the areas where GDPR most clearly applies, such as for:
- Sending commercial e-mails: before including e-mails in their databases, companies must obtain explicit consent from users to process their data for marketing purposes.
- Personalised advertising: platforms must also have users’ consent in order to display personalised advertisements based on browsing behaviour or personal data.
Online applications and services
GDPR consent also affects registration processes for online services. This applies to all uses of personal data:
- Creating accounts and profiles: consent may be required to process personal data to set up a profile or account when a user registers on a website or app.
- Geolocation data collection: apps must also obtain explicit consent to use the user’s GPS location data.
Cookies and online tracking in the General Data Protection Regulation
This is undoubtedly one of the highest profile areas affected by this legislation:
- Installing cookies: websites that use cookies to track user behaviour and analyse user activity, or for advertising purposes, must use a banner or notification to obtain explicit consent.
- Tracking technologies: the use of tools such as pixels or beacons also requires consent, especially if they are used for commercial or tracking purposes.
GDPR consent in the health sector
Data in the health sector is especially sensitive and GDPR compliance is therefore of the utmost importance:
- Processing medical data: due to the sensitive nature of this data, companies must obtain explicit consent to collect, process or share health data (such as medical history or genetic information) with health centres, laboratories, universities, etc.
- Clinical trials: in medical research, participants must consent to the collection and processing of their data for scientific purposes.
Human resources
Like the health sector, the HR sector also deals with highly sensitive information that must be protected:
- Recruitment: companies that collect personal data from candidates for selection or recruitment purposes must seek the applicants’ consent.
- Staff tracking: if a company wants to use staff monitoring measures, such as email tracking, the use of cameras, geo-positioning, etc., it must obtain the employees’ consent.
Finance and insurance
The financial sector is another that has undoubtedly been greatly impacted by the General Data Protection Regulation:
- Processing of financial data: consent must be obtained in order to process data related to a customer’s creditworthiness or credit history or to share them with other group companies.
- Insurance policies: insurers must seek consent to collect data on users’ medical history or behaviour in order to calculate premiums and risks or share data with partner companies.
