Nowadays, secrecy and protection of personal information have become one of the key aspects of doing business. Taking into account strict legal requirements and regulations on the processing of personal data, companies need to be highly responsible and attentive to this issue. In this article, we will look at the importance of consent in processing personal data, what to pay attention to when obtaining consent, and how to appropriately interact with customers in this area.
Is consent to the processing of personal data always necessary
Companies may process personal data without the consent of individuals only in permitted cases.
In general, personal data can only be processed with an individual’s consent. Such cases include the processing of unique personal data. Particular personal data includes data related to race, nationality, political and religious views, prosecution before the law, and biometric and genetic personal data.
Processing of personal data without the consent of a person
1. Sometimes, an individual’s consent is not required to process unique personal data. In particular, without the permission of an individual – the subject of personal data, they are processed in the following cases:
- When an individual has made their personal data publicly available, for example, he posted it on his social networks or in a resume on a recruiting site.
- When applying for a job applicant and in the course of work in certain cases.
- For various legal purposes, the execution of court orders, and the conduct of legal proceedings.
- When government agencies need such data.
2. The State has established permitted cases when consent is not necessary for the processing of other personal data that are not special. These cases, in particular, are related to the conduct of lawsuits, notarial activities, the conclusion of a contract with a personal data subject, and when the processing of personal data is the responsibility of government agencies and companies.
Why is it important to obtain consent for the processing of personal data
It is essential to obtain the consent of an individual to the processing of his personal data for several reasons:
- Protection of citizens’ rights and freedoms
Consent allows an individual to control which of his data will be used, which ensures the protection of his rights. - Legal Requirements
In many countries, data protection laws require consent to the processing of personal data, which helps avoid legal consequences for the company. Belarus provides for a fine of up to 50 basic units (up to 2000 Belarusian rubles, which is about 560 euros) for violating the rights of individuals when processing personal data. - Transparency and trust
Obtaining consent creates an atmosphere of trust between the operator and the data subject since the latter knows how and why his data will be used. - Processing conditions
The consent establishes clear conditions for data processing, including goals, deadlines and methods of use, which contributes to greater clarity in matters of personal data protection.
Thus, obtaining consent is integral to compliance with legal norms and principles of ethical treatment of personal data.
What are the requirements for consent to the processing of personal data
Consent is one of the essential grounds for processing personal data. With consent, individuals can dispose of their data.
When obtaining consent, it is essential to ensure that it is:
- Free.
This means that it is not necessary for an individual to form the opinion that his consent will be forced, that it is consent without a choice. An individual should be given a choice: to give permission or not. When the operator needs to obtain consent for several purposes of processing personal data, permission is obtained separately for each purpose. The supervisory authority, the National Center for Personal Data Protection, recommends this.If personal data does not relate to information necessary to access the site’s services and features (cookie walls), then access to such services and features does not need to be made dependent on consent. In this case, regardless of giving consent, the person must be able to use the site’s services and features. - Unambiguous.
It is necessary to provide an individual with the opportunity to give unequivocal consent in the form of a conscious action. The action must be affirmative: tick the box, click the button, and the like. At the same time, an individual must be given a choice: to give consent or not. To do this, you can provide a person the opportunity in the form of these two options and ask them to make a choice. - Informed.
This consent requirement means that before obtaining consent, you need to provide certain information to the person (you can in the consent itself):
- The name and address of the operator.
- The purposes for which personal data will be processed.
- A list of personal data for which consent is required to be processed.
- The validity period of this consent.
- Information about the persons authorized to process personal data in case third parties do it.
- A list of actions with personal data that require consent, as well as a general description of the processing methods used by the operator.
- Other information is necessary to ensure transparency of the personal data processing process.
- The person also needs to explain to the person his rights related to the processing of personal data, how he can exercise his rights and the consequences of his consent to the processing of personal data or refusal.
Which personal data does not require consent to be processed
You do not need to ask a person for consent to process excessive personal data. This personal data is not required for the processing purpose for which it is requested. For example, personal data on an individual’s income and family members are not required to purchase a subscription to an online service update. The personal data for the processing of which an individual’s consent is requested must correspond to the purpose of processing personal data.
What should consent to the processing of personal data look like?
The operator must ensure that the individual agrees to the processing of personal data in one of the following forms:
- In writing.
In this case, an individual is offered a consent form developed considering the situation’s specifics. - In the form of an electronic document.
In this case, an individual should be able to sign consent using an electronic digital signature using a private key issued in the State Public Key Management System for Verifying an Electronic Digital Signature of the Republic of Belarus – GosSUOK. - Another affirmative action in electronic form.
Such an action can be, for example, putting down a code that comes to an email, messenger or in the form of an SMS, putting a mark of consent on the company’s website. The list of other affirmative actions in electronic form is not defined. Therefore, in this way, it is possible to obtain consent in any form that will confirm that the requirements for consent have been fulfilled. It is free, unambiguous and informed, does not require processing excessive personal data and contains the purposes for which personal data is needed.
Can an individual withdraw his consent to the processing of personal data
An individual can withdraw his consent to the processing of personal data. A person is not required to provide reasons for revoking consent.
It is possible to develop and propose an application form for revoking consent to processing personal data, but this is not necessary.
An individual’s application for withdrawal of consent is submitted on paper or as an electronic document. When consent is taken through the site, it is necessary to provide the opportunity to revoke consent in the same way – through the site.
The application for withdrawal of consent is considered within 15 days. If there are no other grounds for processing personal data, then within this period, it is necessary to:
- Stop processing personal data.
- Delete personal data.
- Notify an individual about the deletion of personal data. If it is technically impossible, the deletion must be blocked and reported to the individual.
How can we help develop and analyze the form of consent of an individual to the processing of his data
Our lawyers and information security specialists are experienced specialists in internal control over processing personal data and protecting information about personal data.
We can:
- Advise you on preparing documents for processing personal data, including consent.
- Analyze the visual display of consent on your online service or application for compliance with the requirements.
- Consult on the issues of bringing consents into compliance after verification by the National Center for Personal Data Protection.
- Advise on the purposes and grounds for processing personal data in each specific case and the registration of consents.
- Consult on the issues of revocation of consents.
- Develop forms of documents for the protection of personal data.
- Represent your interests in government agencies.
Contact us
If you have any questions or disputes regarding personal data, we will be happy to help! Our long-term experience in corporate law and taxation will help you resolve any disputes in this area.
- +37529366-44-77 (WhatsApp, Viber, Telegram);
- info@ambylegal.by.
