Don’t Ask For Consent! I am often met with concerned faces or an intake of breath when I give customers this advice. There has long been an over-reliance on consent as a gateway for processing special category data – particularly in health where risk-averse attitudes can propagate the acceptance that consent is the only unequivocal, lawful approach to such processing.
On the contrary, the threshold for obtaining lawful, valid consent for processing personal data is high – for health and social care in particular. Setting aside the difficulties with obtaining consent that is unambiguous, specificand informed– let’s focus solely on the ‘power imbalance’ for now.
GDPR Recital 43 tells us that consent (freely given as it must be) shall not be valid where there is a clear imbalance between the data subject and the controller – in particular where the controller is a public authority. The ICO provides further clarity, explaining that data subjects may depend on public sector services or fear adverse consequences, potentially rendering consent invalid.
The recent European Data Protection Board (EDPB) opinion on Clinical Trials went further and determined that consent is not freely given when a participant of a trial is ‘not in good health’ or when they belong to an economically or socially disadvantaged group or in any situation of institutional or hierarchical dependency.
Recently, I reviewed a project for High Intensity Users of the health system intended to create a multi-disciplinary team around the most poorly of patients, often with mental health needs. The approach here was to seek consent. It seemed even less appropriate for this particular group or their advocates, with complex needs and sometimes fluctuating capacity, to present them with long winded consent forms (such that they would need to be to satisfy the ‘informed’ component of lawful consent).
We have now started to see this playing out in penalties with the recent fine issued in Sweden to a local authority trialling facial recognition on students in Sweden to monitor attendance. Here, amongst other concerns, the watchdog made it clear that the school board can’t use a student’s consent because there is an imbalance of power between the student and the school board – such that students do not feel there is a genuine choice.
The overuse of consent can be frustrating, particularly given the existence of the broad and comprehensive “medical purposes” gateway. I hope in time we will see these attempts to squeeze a “square peg into a round hole” start to drop away and more use of the ‘Inform and Object’ approach. More confidence must be placed in the ‘medical purposes’ gateway and time and effort channelled away from endless consent forms for poorly patients and towards regional / national awareness campaigns. This way we can work on raising the ‘reasonable expectations’ of patients, satisfying common law and providing legitimate opportunities to object.
#consent #power #lawfulprocessing #GDPR #informationlaw
To attend one of our Consent Webinars email us at [email protected]
To book a Review of Your Consent Mechanisms email us at [email protected]
