GDPR and Conditional Consent

Transcript of the Video

Good afternoon, ladies and gentlemen. Suzanne Dibble here, data protection law expert coming to you raw and uncut.

Looking slightly windswept today after my day on a speedboat going to James Bond Island and other islands around Phuket. Bonus points for anyone who can tell me which James Bond film James Bond Island was seen in. I have to say, it's an absolutely stunning place. You'd absolutely recognize it. If you know what I'm talking about ... such an iconic scene in one of the James Bonds movies. But anyway, enough about me and James Bond Island.

Tonight I want to talk to you about consent and conditional consent. We had a good question in the group earlier today that prompted me to do this video because I've talked about this area in part of my other videos but I think it's worth doing something specifically on this, and the question that comes up today prompted it.

The question in the group was, "Can I still offer a discount code for people on the condition that they sign up for our newsletter, or won't that be compliant with GDPR?" I'm going to answer that question but also the wider context of consent being conditional.

Firstly, if you've watched any of my videos you'll know to remember that consent is just one round of processing. Not everything requires consent, so always bear that in mind. But if you do need consent then the definition of consent is: "Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she by a statement or by a clear affirmative action signifies agreement to the processing of personal data relating to him or her." So the   keywords that we are going to focus on for the purposes of this video are "freely given." What does "freely given" mean? Consent is only valid for GDPR purposes if it is freely given.

Now Article 7 says, "When assessing whether consent is freely given, utmost account shall be taken of whether inter alia,"—which is a lawyer's term—"the performance of a contract including the provision of a service is conditional on consent to the processing of personal data that is not necessary for the performance of the contract." Therefore, there is a presumption that consent is not freely given when it's conditional to receive the provision of a service, despite such consent not being necessary for such performance.

However, that is just one consideration of whether consent is freely given, and note that it is not saying that if consent is conditional then it is definitely not freely given and therefore not compliant. What it's saying is, you've got to take account of the fact. In deciding whether consent is freely given you've got to take account of the fact that the performance of a contract is conditional on consent to the processing of personal data that's not necessary.

So what could be an example there? Say you are selling widgets to your customer, and you at the checkout point in your online shop say, "Mr. Customer, thanks very much for purchasing your widget. In order to process this sale, please tick here to allow us to transfer your data to other third parties who can send you details of goods and services that we think might interest you." That's conditional consent, and arguably it's not freely given because the person really wants to buy the widget but what you're saying to them is, "You can only buy that widget if you agree to us giving your data to a third party so that they can send you marketing emails." That's not allowed, because that consent is not freely given, especially where you're the only seller of that particular widget.

As I say, though, that is just one element of looking at whether consent is freely given. Other things to take into account are the balance of power between the data subject—the person whose personal data you're processing—and you, the data controller. An example is given that if it's a public authority who is the controller then that would be an example of where there's a clear imbalance, and if the data subject didn't have a genuine or free choice about consent or is unable to refuse or withdraw consent without detriment then that would not be freely given.

It says, "Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case." So we know what that's about, don't we? If you've watched any of my videos you'll know that's about the granularity of consent. If you're bundling together your consents and not allowing separate consents for different processing operations then consent is not presumed to be freely given for that.

And you've got to think about the existence of alternative options out there. So if you are the only provider of this certain widget and you're making it a condition of consent that they have to let you send them marketing emails, for example, then that is not going to be freely given consent and it won't be compliant.

So making consent conditional is just one factor in looking at whether consent is freely given.

So back to the original question, which was, "Can we offer a discount code for people on the condition that they sign up for their newsletter?"

Well, my first question as a lawyer is what is the contract there, because for a contract to exist you've got to have a number of things. You've got to have an offer, an acceptance, consideration. If you're just saying to people, "Here's a free discount code," then there's no contract there. If you're saying to them, "Here's a discount code," and the consideration is their email address, then I think that's fine. Anyway, whichever legal way you want to look at it, in my view you would be absolutely fine offering a discount code and saying, "Sign up for the newsletter," because in my view that is not taking away the data subject's right to freely give their consent—unless you've got the most desirable widget ever. But if you're just saying to them, "Look, we'd love to give you this discount code, and if you do we're going to send you our newsletter" ... Now as long as you always let them opt out, which of course I'm sure you would do, then I just can't see that you're going to get any problems with that. I think you'd have a very good argument to say that the consent was still freely given because if they don't want your newsletter, they don't sign up for your discount code. So in my view, that's still freely given consent.

So there you have it. As I say, do remember the example that I gave that clearly wouldn't work, which is where you've got that clear contract where someone's paying for goods and services, and you are saying that as part of that they have to receive your marketing or you'll transfer it to third parties.

Now, remember, I'm only talking about consent here. This is the lawful ground of processing of consent. If there's anything else, like legitimate interest, this doesn't apply. But if you are going to your customers and saying, "I need to have consent for marketing," and you are incorporating that consent and wrapping it up into a condition of the sale of the services or the goods then you need to be very careful about that and make sure that that consent is still freely given.

So I shall leave it there. I hope that made sense. I'm a little bit sway after the boat today, and it's now 12:45 AM, because I've just been doing an interview for Digital Marketer, and 11 o'clock at night was the only time they could do because they're in ... somewhere. California? Texas? Not sure. Anyway, somewhere that's many time zones away. So I hope that made sense. If it didn't, just let me know and I'll do another one.

But the message I want to get through is: lots of people know about this concept that consent can't be conditional, but I just want to make the point it all relates back to whether the consent is freely given, and if when you look at all the other factors in the round you can say that consent is freely given then you're okay.

All right. I'm going to go. I've got a big cough coming, so I'm going to end it there. I'll see you soon.