D11.3: Economic aspects of mobility and identity

Title: CONSENT

Consent

As already mentioned, personal data may be processed if the data subject “has unambiguously given his consent”. While this provision is the most common basis for processing data in the electronic communications sector, it presents interesting particularities when it comes to mobility. The data subject’s consent shall mean any “freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”. This definition explicitly rules out consent being given as part of accepting the general terms and conditions for the electronic communications service offered.

It is very important for the companies to interpret correctly the aforementioned legal provision in order to avoid violations of the data protection legislation and mainly to examine what freely given, specific and informed means. A freely given consent should not be counterpart of an advantage or subject of negotiations on behalf of the data controller. The consent needs to be specific, meaning that it should be given for a specific and identified scope. Finally, it needs to be informed; the user shall get the appropriate and sufficient information before the collection of the data and such information shall be in clear language and of course in a language that the data subject understands. A highly debated issue is whether consent can be expressed in an opt-in or in an opt-out way. It is necessary that “there must be some form of communication whereby the individual knowingly indicates consent”. This can be expressed by ticking a box, or sending an e-mail or subscribing to a service.

For the processing of sensitive data the data subject shall give his explicit consent, although Member States may prohibit the processing of sensitive data, even with the consent of the data subject. Such legislation is very important to be known and respected. The French Data Protection Authority (CNIL) published for instance a recommendation on websites dedicated to health care matters pronouncing among others that “health care data related to an identified or identifiable person may not be bought or sold, even if individuals to whom these data refer have given their consent”.

Traffic data relating to subscribers and users processed and stored by the provider of a public communications network or publicly available electronic communications service must be erased or made anonymous when they are no longer needed for the purpose of the transmission of a communication. However the aforementioned providers may process traffic data for the purpose of marketing electronic communications services or for the provision of value added services, if the subscriber or user to whom the data relate has given his prior consent. A highly debated issue is how the prior given consent can be expressed. ‘Some form of communication whereby the individual knowingly indicates consent’ (opt-in) is essential.

The sending of unsolicited communications for the purposes of direct marketing using automatic calling machines, faxes or electronic mail for the purposes of direct marketing is broadly used by companies. However this is only allowed in respect of subscribers (and not users) who have given their prior consent. Although the rule for sending unsolicited communications is the acquisition of the prior consent of the data subject, Art. 13(2) data protection directive provides for an exception in the case of existing customers. According to this exception, when a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, it may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details when they are collected and on the occasion of each message in case the customer has not initially refused such use (opt-out).

How the similarity between products and services can be defined is a matter of interpretation, differentiating between the Member States. Furthermore an issue closely related to mobility is whether a mobile communications provider is allowed to send SMS to his pre-existing customers for direct marketing of his own similar products or services. The ePrivacy directive mentions in Art. 13 (2) that a natural or legal person can only use the customer’s ‘electronic contact details for electronic mail’ to send e-mails for the aforementioned purposes. Any other form of personalised marketing techniques, such as personalised mobile marketing and advertisement services shall fall outside the scope of this article. Therefore a mobile communications provider shall not be allowed to send SMS to his pre-existing customers for direct marketing of his own similar products or services.