Cybersecurity, Privacy And Data Protection III

Validity of Consent

Before an organization can collect, use or disclose an individual's personal information, the organization needs the individual's consent or a statutory exception to the consent requirement. Consent can be express or implied. Express consent involves a positive affirmation or acceptance and may be required for sensitive personal information (such as medical or financial information or large volumes of non-sensitive information). Implied consent may be sufficient for non-sensitive personal information (such as a mailing address). Consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization's activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting. Further, the OPC and Privacy Commissioners of British Columbia and Alberta have issued joint Guidelines for obtaining meaningful consent