EU data chiefs finally release GDPR consent guidance
With just 30 days to go until GDPR comes into force, EU data protection chiefs have finally released their guidance on consent under GDPR, leaving the UK Information Commissioner's Office just weeks to unpick the findings before May 25.
The ICO has been waiting for the Article 29 Working Party to issue its final guidance before releasing its own version, although the UK regulator has consistently said that it does not foresee wholesale changes to its draft guidance, issued last year.
Under the new A29WP version, agreed at the last plenary meeting in February but only just published, there appears to be only one major change. There is a new section addressing requests for consent online, after members of the group deemed the initial guidance to be inadequate.
It states: "Controllers must avoid ambiguity and must ensure that the action by which consent is given can be distinguished from other actions. Therefore, merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation."
How this will pan out in the ICO guidance, remains to be seen.
The ICO had originally said it would publish its consent guidance in June 2017, but this was then delayed until December and then again until A29WP had met. At the time, an ICO spokesman said: “Once this has happened, our guidance will follow."