Organizations that leverage consent as a legal basis for data processing have to undergo many challenges to ensure that all valid consent elements are fulfilled. The automation-based PrivacyOps approach enables organizations to address those challenges and ensure all valid consent elements are adequately fulfilled.
Universal Consent Management enables organizations to capture consent and automate revocation fulfillment in a simplified and automatic manner.
Why is Universal Consent Management needed?
Under most global privacy laws, personal data can be processed only if there is a lawful basis to do so. The data subject’s consent is one of the lawful basis of personal data processing. In some circumstances, the data subject’s consent may be the only lawful basis of personal data processing.
If an organization relies on the data subject’s consent for personal data processing. In that case, it must demonstrate that the processing is taking place only once the data subject has consented to such processing.
Consent as a lawful basis for data processing is not limited to using personal data for advertising and marketing purposes. Instead, it is essential wherever the possibility of identifying the individual exists. Organizations must obtain the data subject’s consent if it is possible to single out an individual, link records relating to an individual, or infer any information concerning an individual.
Universal Consent Management under GDPR and e-Privacy Directive
The GDPR and e-Privacy Directive are based on opt-in consent regimes, requiring consent to be freely given, specific, informed, and unambiguous indication of the data subject’s wishes.
Data subjects also have the right to withdraw their consent at any time. It is important to note that consent withdrawal shouldn’t affect the lawfulness of data processing. Once an individual opts out from the organization’s marketing communications, the organization must not send them any further marketing communications nor invite them to opt back into marketing.
Organizations must obtain the explicit consent of the data subject for the processing of special categories of data. These categories include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a natural person’s sex life sexual orientation.
In the digital context, the organization may obtain explicit consent in the form of an electronic signature, an email, an uploaded scanned document, or any other similar mechanism to ensure the data subject’s express and explicit consent.
Organizations must be careful while processing employees’ personal data based on their consent. In most cases, employees do not have genuine freedom to consent due to an unequal balance of power in an employer-employee relationship. Therefore, consent should effectively be a measure of last resort for an employer to turn to.
Universal Consent Management under CCPA
The CCPA treats consent as an affirmative authorization of data subjects to allow the sale of their personal data.
The CCPA is based on an opt-out consent regime that does not require organizations to obtain the data subject’s consent before collecting and processing their personal data.
However, organizations must not collect and process any personal data before notifying data subjects about the categories of personal data to be collected and their purposes, retention periods, providing users the option to opt-out, and letting them acknowledge the notification.
The CCPA requires organizations to obtain consent from minors concerning the sale of their personal data.
If a business is confident that the data subject’s age is less than 16 years, it must not sell personal data without taking consent from the minor.
For data subjects aged 13 years or less, the organization must obtain consent from their parent or guardian.
