[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"guide_explicit-consent_56303":3},{"tableOfContents":4,"markDownContent":5,"htmlContent":6,"metaTitle":7,"metaDescription":7,"wordCount":8,"readTime":9,"title":10,"nbDownloads":11,"excerpt":12,"lang":13,"url":14,"intro":15,"featured":4,"state":16,"author":17,"authorId":18,"datePublication":22,"dateCreation":23,"dateUpdate":24,"mainCategory":25,"categories":32,"metaDatas":57,"imageUrl":7,"imageThumbUrls":58,"id":59},false,"## A requirement of the GDPR\r\n\r\nExplicit consent is required in several cases by the GDPR: \r\n\r\n### Collection of sensitive data\r\n\r\n**Article 9 of the GDPR** states that the processing of specific (or sensitive) data is prohibited by its very nature, subject to certain exceptions. These exceptions include the individual's explicit consent.  \r\n\r\n### Automated decision-making\r\n\r\n**Purely automated** decision-making mechanisms that produce legal effects or significantly affect the individual are prohibited. Here again, an exception provided for by Article 22 c) of the GDPR on the basis of the person's explicit consent allows this.  \r\n\r\n### Transfers outside the EU\r\n\r\n**Transfers outside the EU/EEA** are subject to minimum guarantees. These guarantees include derogations for specific situations, including explicit consent (Article 49 1. a).\r\n\r\n\r\n## The explicit nature of consent\r\n\r\nThis explicit nature is **not defined in the GDPR** but it can be compared with other provisions, for example, **express consent** within the meaning of Article L. 1122-1-1 of the French Public Health Code concerning interventional public health research on the human person involving minimal risks. \r\n\r\nThe legislator's intention is thus to seek **stronger consent** than \"traditional\" consent. \r\nIn particular, explicit consent must be **free**, **specific**, **informed** and **unambiguous**. But it must also **be affirmed in a clear statement**. \r\nIn short, explicit consent **must not be capable of being inferred from a person's actions**, but **must be characterised by words that are clearly expressed** (in writing or orally, but proof will be easier in writing). \r\n\r\nYou might think of civil marriage, which is a good example of explicit consent between spouses. \r\n\r\nA declaration of explicit consent must also **make specific reference to the element of the processing** that requires explicit consent. For example, the statement must specify the nature of the sensitive data, the details of the automated decision and its effects, or the details of the data to be transferred and the risks of transferring it outside the EU/EEA where applicable.\r\n\r\nFinally, in accordance with Recital 43 of the GDPR, **explicit consent must be separated from other consent where applicable**. \r\n\r\n## Examples of explicit consent\r\n\r\nA few examples are provided for the data controller:\r\n\r\n* A consent collection box that is not pre-checked\r\n* A written declaration signed by the data subject\r\n* The sending of a verification email to the person consenting to the processing of this sensitive data.\r\n\r\n\r\n\r\n**Example**: a beauty salon asks for skin colour on the registration form. \r\n\r\n*As this data is sensitive (revealing racial or ethnic origin), explicit consent must be requested.*\r\n\r\n☐ I agree to the use of information about my skin colour to receive offers of appropriate beauty products. ","\u003Ch2 id=\"a-requirement-of-the-gdpr\">A requirement of the GDPR\u003C/h2>\r\n\u003Cp>Explicit consent is required in several cases by the GDPR:\u003C/p>\r\n\u003Ch3 id=\"collection-of-sensitive-data\">Collection of sensitive data\u003C/h3>\r\n\u003Cp>\u003Cstrong>Article 9 of the GDPR\u003C/strong> states that the processing of specific (or sensitive) data is prohibited by its very nature, subject to certain exceptions. These exceptions include the individual's explicit consent.\u003C/p>\r\n\u003Ch3 id=\"automated-decision-making\">Automated decision-making\u003C/h3>\r\n\u003Cp>\u003Cstrong>Purely automated\u003C/strong> decision-making mechanisms that produce legal effects or significantly affect the individual are prohibited. Here again, an exception provided for by Article 22 c) of the GDPR on the basis of the person's explicit consent allows this.\u003C/p>\r\n\u003Ch3 id=\"transfers-outside-the-eu\">Transfers outside the EU\u003C/h3>\r\n\u003Cp>\u003Cstrong>Transfers outside the EU/EEA\u003C/strong> are subject to minimum guarantees. These guarantees include derogations for specific situations, including explicit consent (Article 49 1. a).\u003C/p>\r\n\u003Ch2 id=\"the-explicit-nature-of-consent\">The explicit nature of consent\u003C/h2>\r\n\u003Cp>This explicit nature is \u003Cstrong>not defined in the GDPR\u003C/strong> but it can be compared with other provisions, for example, \u003Cstrong>express consent\u003C/strong> within the meaning of Article L. 1122-1-1 of the French Public Health Code concerning interventional public health research on the human person involving minimal risks.\u003C/p>\r\n\u003Cp>The legislator's intention is thus to seek \u003Cstrong>stronger consent\u003C/strong> than \"traditional\" consent.\r\nIn particular, explicit consent must be \u003Cstrong>free\u003C/strong>, \u003Cstrong>specific\u003C/strong>, \u003Cstrong>informed\u003C/strong> and \u003Cstrong>unambiguous\u003C/strong>. But it must also \u003Cstrong>be affirmed in a clear statement\u003C/strong>.\r\nIn short, explicit consent \u003Cstrong>must not be capable of being inferred from a person's actions\u003C/strong>, but \u003Cstrong>must be characterised by words that are clearly expressed\u003C/strong> (in writing or orally, but proof will be easier in writing).\u003C/p>\r\n\u003Cp>You might think of civil marriage, which is a good example of explicit consent between spouses.\u003C/p>\r\n\u003Cp>A declaration of explicit consent must also \u003Cstrong>make specific reference to the element of the processing\u003C/strong> that requires explicit consent. For example, the statement must specify the nature of the sensitive data, the details of the automated decision and its effects, or the details of the data to be transferred and the risks of transferring it outside the EU/EEA where applicable.\u003C/p>\r\n\u003Cp>Finally, in accordance with Recital 43 of the GDPR, \u003Cstrong>explicit consent must be separated from other consent where applicable\u003C/strong>.\u003C/p>\r\n\u003Ch2 id=\"examples-of-explicit-consent\">Examples of explicit consent\u003C/h2>\r\n\u003Cp>A few examples are provided for the data controller:\u003C/p>\r\n\u003Cul>\r\n\u003Cli>A consent collection box that is not pre-checked\u003C/li>\r\n\u003Cli>A written declaration signed by the data subject\u003C/li>\r\n\u003Cli>The sending of a verification email to the person consenting to the processing of this sensitive data.\u003C/li>\r\n\u003C/ul>\r\n\u003Cp>\u003Cstrong>Example\u003C/strong>: a beauty salon asks for skin colour on the registration form.\u003C/p>\r\n\u003Cp>\u003Cem>As this data is sensitive (revealing racial or ethnic origin), explicit consent must be requested.\u003C/em>\u003C/p>\r\n\u003Cp>☐ I agree to the use of information about my skin colour to receive offers of appropriate beauty products.\u003C/p>\r\n",null,430,2,"Explicit consent",0,"Explanation of explicit consent in the GDPR","en","explicit-consent","Explicit consent is required in certain cases. ","Published",{"id":18,"displayName":19,"avatarUrl":20,"bio":7,"blogUrl":7,"color":7,"userId":18,"creationDate":21},38,"Paul-Emmanuel Bidault","https://static.dastra.eu/tenant-27/avatar/38/paul-emmanuel-bidault-150.jpg","2019-12-03T19:09:28","2023-12-26T14:02:23.027","2023-12-26T15:02:22.3740212","2023-12-26T15:05:42.8128429",{"id":26,"name":27,"description":7,"url":28,"color":29,"parentId":7,"count":7,"imageUrl":7,"parent":7,"order":30,"translations":31},23,"Base de connaissance","guide","#1f9323",1,[],[33,55],{"id":34,"name":35,"description":36,"url":37,"color":38,"parentId":26,"count":7,"imageUrl":39,"parent":40,"order":11,"translations":42},21,"Glossary","Definition of every word used by Dastra","glossary","#643bb0","https://static.dastra.eu/tag/b308b9d3-37af-4e92-8354-ab8adec1740a/documentation-1000.png",{"id":26,"name":27,"description":7,"url":28,"color":29,"parentId":7,"count":7,"imageUrl":7,"parent":7,"order":30,"translations":41},[],[43,47,51],{"lang":44,"name":45,"description":46},"fr","Glossaire","La définition de tous les termes utilisés dans Dastra",{"lang":48,"name":49,"description":50},"es","Glosario","La definición de todos los términos utilizados en Dastra",{"lang":52,"name":53,"description":54},"de","Glossar","Die Definition aller in Dastra verwendeten Begriffe",{"id":26,"name":27,"description":7,"url":28,"color":29,"parentId":7,"count":7,"imageUrl":7,"parent":7,"order":30,"translations":56},[],[],[],56303]