Grouping together consent into one form (GDPR)

[Bruce123]

I am just wondering if it's OK to bundle together consent for several uses of personal data (inc Biometrics) into a single agreement with one signature, without the option to select which ones you agree to? I.e. all or nothing approach. For staff / parents / students. Any thoughts?

 

Thanks,

 

Bruce.

[forkies]

My understanding is, it needs to be clear informed consent, this is the option to say Yes or No, without default option.

 

You cannot ask someone to consent to all options grouped otherwise they cannot decline an individual consent item. Such as they may want to decline consent for Biometrics, you have to allow them to decline, if it is grouped they cannot.

[Arthur]

Definitely not bundled together.

 

https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf

 

What is valid consent?

 

In brief…

• Consent must be freely given; this means giving people genuine ongoing choice and control over how you use their data.
  
• Consent must specifically cover the controller’s name, the purposes of the processing and the types of processing activity.
  
• Consent requests must be prominent, unbundled from other terms and conditions, concise and easy to understand, and user-friendly.
  
• Consent should be obvious and require a positive action to opt in.
  
• Explicit consent must be expressly confirmed in words, rather than by any other positive action.
  
• There is no set time limit for consent. How long it lasts will depend on the context. You should review and refresh consent as appropriate.
  

Edited May 14, 2018 by Arthur

[enjay]

My understanding is you can do it on one form, but there must be the option to consent/refuse individually. Tick boxes for each thing and a signature at the end should do it. I think!

[Bruce123]

Definitely not bundled together.

 

https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf

 

"Consent requests must be prominent, unbundled from other terms and conditions, concise and easy to understand, and user-friendly."

 

I wondered this, but the consent form is unbundled from other terms and conditions, the consents are just bundled together.

[elsiegee40]

The law is written to prevent an all or nothing approach. You must have the right to refuse part of it... eg accept photos... but only for internal use (refuse for marketing), refuse biometrics completely...

 

It’s a nuisance, but you must be specific about how you will use the data and give the right to refuse each specific instance.

Edited May 14, 2018 by elsiegee40

[enjay]

I wondered this, but the consent form is unbundled from other terms and conditions, the consents are just bundled together.

 

I think your problem would come from the bundled consent. Someone might have a reason they don't want photos to appear online but be perfectly happy with biometrics in the dining hall. Bundling consent could be seen as strong-arming them into giving photo consent, because of how much else you would take away if they decline.

[MrBitey]

Yep. I agree. All of the consents need to be unbundled and clearly explained. It's a pain but that's the way it is now.

[jmak]

The OP is proposing granular consent - it's just putting it all in one form that he's querying.

 

i.e. a single signature, but confirming that you do consent to some of the choices and not to others. As long as you're clear on each item, I can't see any reason in the advice not to have a single consent form. You're not allowed to bury it in amongst terms and conditions or say "I agree to all of the above". A single form is similar to the way it's presented in the SIMS Parent App; there's a single page for all consents you're being asked for, you select which ones you accept, with all set to decline as default, then select save and submit. A single submission, but with an option for consent on each item. It wouldn't be beneficial to the user to have to fill out multiple forms for each organisation.

Edited May 16, 2018 by jmak

[enjay]

The OP is proposing granular consent - it's just putting it all in one form that he's querying.

 

Not true. He is proposing, to use his words, an "all or nothing" consent.

[jmak]

Not true. He is proposing, to use his words, an "all or nothing" consent.

My bad [emoji849]

 

Your first answer is exactly what I'd go with....

Edited May 16, 2018 by jmak