
Laws Still Apply to Bad Ideas
On Monday, I posted that “Forcing Consent Is A Bad Idea“. The point was to tell say that, regardless of legal issues, there are very practical reasons in favor of setting a policy of not trying to force consent.
But, just because there are practical reasons for not forcing consent does not mean that there are not also legal considerations to be made. Sometimes, laws even prohibit ill-advised decisions outright. And, depending on the jurisdiction, those laws may apply to you.
For instance, the CRTC has stated with regard to the collection of express consent under CASL that “The Commission considers that requests for consent contemplated above must not be subsumed in, or bundled with, requests for consent to the general terms and conditions of use or sale. The underlying objective is that the specific requests for consent in question must be clearly identified to the persons from whom the consent is being sought. For example, persons must be able to grant their consent to the terms and conditions of use or sale while, for instance, refusing to grant their consent for receiving CEMs” (Compliance and Enforcement Information Bulletin CRTC 2012-548 at ¶16). Thus, the forced creation of an account to view a website cannot provide the basis for an extension of expressed consent as that would subsume the consent into the general terms or the conditions of use.
The violation under the GDPR is even more evident. According to the GDPR, “When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.” (Regulation [EU] 2016/679, Article 7(4).) Further, Recital 42 says that “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.” And, finally, Recital 43 states that “Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance” (emphasis added).
Thus, forcing consent would appear to be a GDPR violation in most instances. At the very least, a company would need to drop any reliance upon consent as their basis for controlling and processing data and find another basis.
But, even if these laws don’t apply to a given program, it’s still just a bad idea to do force consent. It’s asking for trouble in a number of ways, both reputationally and potentially legally.
Bibliography
- Mickey Chandler (2020, January 27), Forcing Consent Is A Bad Idea. Retrieved January 29, 2020 from https://www.spamtacular.com/2020/01/27/forcing-consent-is-a-bad-idea/.
- Regulation [EU] 2016/679 (2016, April 27). Official Journal of the European Union. Retrieved January 29, 2020 from Official Journal of the European Union: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN.
- Canadian Radio-television and Telecommunications Commission (2012, October 10), Compliance and Enforcement Information Bulletin CRTC 2012-548.
Archives
- November 2021
- July 2020
- June 2020
- March 2020
- February 2020
- January 2020
- November 2018
- February 2018
- January 2018
- December 2017
- January 2017
- August 2016
- June 2016
- April 2016
- March 2016
- February 2016
- July 2015
- June 2015
- March 2015
- February 2015
- November 2014
- June 2014
- April 2014
- February 2014
- December 2013
- November 2013
- September 2013
- May 2013
- June 2012
- April 2012
- September 2011
- August 2011
- March 2011
- January 2011
- November 2010
- July 2010
- May 2010
- April 2010
- March 2010
- February 2010
- December 2009
- November 2009
- October 2009
- July 2009
- June 2009
- May 2009
- March 2009
- January 2009
- October 2008
- September 2008
- April 2008