Title: .A.5. THE CONSENT PRINCIPLE

According to article 7, to be legitimate, the processing of personal data may only take place if the data subject has unambiguously given his consent or if the processing is necessary for:

1. the performance of a contract to which the data subject is party, or for taking steps at the request of the data subject prior to entering into a contract, or  

2. compliance with a legal obligation to which the controller is subject, or  

3. protecting the vital interests of the data subject, or  

4. the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed, or  

5. the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject.

The consent principle of article 7 is a corner stone for data protection. Consent by the data subject is defined as “any freely given, specific, and informed indication of his wishes” (article 2.h). Consent for the collection of data that are not sensitive, may be given orally. In the case of collecting and processing of sensitive data, the consent given must be explicit (article 8 - 2.a). Especially the last condition of article 7 seems to give a free way to data controllers to collect personal data without consent. The question is who determines when data collection for the purpose of profiling is in fact necessary for the legitimate interest of the data controller or a third party. If we combine the fact that - in practice - most of the time data subjects do not know that or which data are collected with the fact that consent is not necessary if profiling is necessary to pursue legitimate interests, then we may infer that in the end the data controller will decide about this necessity.