David Miller, Solicitor & head of commercial contracts law at Flint Bishop LLP

A recently published opinion by an EU working party concerning the definition of “consent” for the purposes of interpreting EU data protection laws may cause concern for businesses in the UK.

The current interpretation of these laws in the UK is that, as long as consent is obtained, it doesn’t matter if this is before or after data processing has begun.

The opinion, however, states that consent should always be given before any processing of data takes place and that any processing which takes place before consent is obtained will be unlawful.  It goes on to state that consent has to be actively given.  Therefore requiring someone to alter their default privacy settings or untick a pre-ticked box in order to refuse consent will not satisfy these requirements.

This opinion is not automatically binding on the UK and the Information Commissioner’s Office hasn’t yet confirmed its position.  It has to be remembered though that the EU is the source of our data protection legislation and so it is not unreasonable to assume that the lawful collection of data is about to get harder.