Industry Insights & News

The significance of implied consent for companies

Die Bedeutung der konkludenten Einwilligung für Unternehmen

The GDPR includes several rules that European Union member states must implement to protect the privacy of digital data. One of the key concepts of the GDPR is consent, which is defined as “any freely given specific, informed and unambiguous indication of his or her wishes by which the data subject signifies his or her agreement, either by a statement or by an unambiguous affirmative act, to personal data relating to him or her being processed.”

In other words, the data subject must give his/her explicit consent to the collection and processing of his/her personal data. However, there are certain circumstances in which implied consent (an implied consent) can be used instead. In this blog post, we will go into more detail about what implied consent is and when it can be used.

What is implied consent?

Implied consent is when a person's actions indicate that they consent to the collection and processing of their personal data, even if they have not explicitly said so. For example, if someone visits your website and fills out a form to receive more information about your product or service, you may assume that the person implicitly agrees that you may contact them.

However, implied consent can only be used in certain circumstances. For implied consent to be valid, several conditions must be met:

There must be a pre-existing relationship between the person and the organization collecting their data. For example, if someone is already a customer/in of your organization, you can assume that he/she consents to you using his/her personal data for marketing purposes.

The request for data must be relevant to the pre-existing relationship. For example, if you run a blog about tax preparation and someone signs up for your mailing list, you can't assume that he/she will also agree to receive marketing emails about another topic (unless you offer both news about tax preparation and that other topic)
The individual must have the opportunity to object to the collection and/or processing of their data. For example, if they check a box on your website's registration form that allows people to opt out of receiving marketing emails, those who do not check the box have not given implied consent
The request for data must be clear and concise. For example, if you have a complex Terms of Service document that most people would not read before signing up for your service, any personal data collected from those who sign up would not be considered implied consent

Secure your competitive advantage

Customers expect data protection—startups can leverage it as a marketing advantage with professional solutions. Learn more in the whitepaper!

Conclusion

Implied consent refers to situations where a person's actions imply their agreement to have their personal data collected and processed, even without explicitly stating so. However, this type of consent is applicable only under specific circumstances: when there is an existing relationship between the individual and the data-collecting organization, the data request is relevant to that relationship, the individual has the chance to object to the data collection or processing, and the data request is clear and specific. If you're uncertain about having someone's implied consent, it's advisable to be cautious and obtain explicit consent instead.