Obtaining user consent when requesting personal data

Consent must be given through a clear affirmative action that reflects a freely given, specific, informed, and unambiguous indication of the data subject's wishes, and must be obtained for all processing activities carried out. When processing has multiple purposes, consent must be obtained for each of them. Where consent is to be given following a request by electronic means, that request must be clear, concise, and not unnecessarily disruptive to the use of the service for which it is provided.

This express consent can be transferred to a web form through the implementation of checkboxes that are unchecked by default. This is vital for being able to demonstrate the person's voluntad to process their personal data.

Pre-checked boxes, silence, and the inaction of the interested party do not constitute lawful data processing, so these formulas should not be used.

In the previous section, we discussed specific purposes, meaning that when someone provides their data, the conditions for data processing must be clearly, unambiguously, and transparently detailed.

As it is express consent tied to a specific purpose, it must be demonstrated that it was collected according to these precepts, and the burden of proof falls upon the organization that receives and processes this data.

An example of how to show that we have been authorized is that each registration generates an automatic reply email with the data of the requested person, their IP, a confirmation checkbox, date, exact time, and the browser they used. This email must be saved as proof in case of conflict with the user.

First layer of basic information

With the requirements and principles introduced by the GDPR regarding the obligation to inform, simply referring to the privacy policy on web forms is no longer sufficient to comply with these obligations.

The European Union Data Protection Authorities recommend using a layered notice model, presenting a first layer with basic data protection information and, from this simpler and more immediate layer, referring to a second layer with the remaining information.

In the Guidance for Fulfilling the Duty to Inform, from the AEPD, states that this first layer of information must meet the following requirements:

– The information must be made available to interested parties at the time the data is requested, prior to collection or registration.

This obligation must be met without the need for any request, and the responsible party must be able to subsequently prove that the duty to inform has been fulfilled.

– It must be clearly identified with a title such as “Basic Data Protection Information.”.

– The controller must ensure that this information remains “within the data subject's field of vision.”.

- Interested parties must receive a copy including this basic information. LOPDGDD, in its article 72, classifies as a VERY SERIOUS INFRINGEMENT the omission of the duty to inform the affected party about the processing of their personal data in accordance with the provisions of articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).