Article 29 Working Party Issues Draft Guidelines On Consent Under GDPR

On 12 December 2017, the Article 29 Working Party ("WP29") published draft guidelines (the "Guidelines") on consent under General Data Protection Regulation 2016/679 (the "GDPR").

Consent is one of six "lawful bases" that allow for the processing of personal data listed in Article 6 of the GDPR (or Articles 9 and 10 of the GDPR for "sensitive" categories of data). Other lawful bases under Article 6 permit, inter alia, the processing of personal data (i) that are necessary for the performance of a contract; (ii) to comply with a legal obligation; or (iii) to pursue a legitimate interest of the controller. Controllers should carefully consider whether consent is the appropriate lawful basis for the envisaged processing or whether another lawful basis should be relied on instead.