6.2 What is consent and why should we communicate proactively?
Now that you have looked at consent in your everyday live, read through the following slides, and then continue to take the small quiz.
Slide 1: What is consent
In a consent agreement a user of technology agrees to the processing of personal data by the institution or company behind the technology.
This is often referred to as informed consent , which is a process whereby users of technology are ‘informed and asked for their permission or agreement prior to their data being collected (which might include taking photographs or recording images)’.
In some cases data processors use implied consent, where the permission to process personal data is not agreed upon but inferred from a person’s action. On websites the scrolling down is sometimes considered implied consent, where the user agrees to data collection and processing not by clicking on ‘I agree’, but by interacting with the website.
Slide 2: How NOT to ask for consent
Watch this 1 min video from Choice Australia on “How long does it take to read Amazon Kindle’s terms and conditions?”:
Slide 3: How do you ask for consent
In countries with Data Protection regulation you need to ask for consent before collecting and processing personal data from citizens. The consent agreement must provide clear and reliable information on
- What personal data will be collected
- For what purpose this data will be collected
- Who will have access to this data
- Who is this data shared with.
As a general rule consent must be given voluntarily.
Slide 4: Terms of Service vs Consent
When registering for a service or tool a user might be asked to agree to a Terms of Service and a consent agreement. So what is the difference?
A Terms of Service stipulates the rules and regulations the user needs to agree to prior to using the service. This can include agreeing to giving access to the Personal Identifiable Information which is needed for the technology to work. For example: the Terms of Service of a chat app might stipulate that the app needs access to your phone number, because without it the chat app will not work. Note that if you do not agree to the Terms of Service, you will not be able to use the service.
A consent agreement covers Personal Identifiable Information that a data processor wants access to but which is not essential to the functioning of the service. In the above example the Terms of Service might cover your phone number, but the consent agreement will cover access to your contact list and your pictures.
Slide 5: Why ask for consent
Consent is often seen as a checkbox, something to do to comply with Data Protection Regulation. However, examples from around the world show that if citizens feel sufficiently informed and involved in decisions about their data they are also more likely to “forgive” if something goes wrong. To achieve this, communication has to go beyond the legal language of a consent form. Especially for local governments asking for consent is actually a great opportunity to engage with the citizens and explain them the details about how the departments plans to use the data.
Slide 6: Best practices for asking consent
As a best practice we recommend to think about it holistically – you will need the consent on the one hand to comply with regulation and hence it will be important to cover legal aspects, on the other hand, you can use particular information from the consent to proactively inform citizen about your plans and the most important functionalities of the service. For the later, remember the following best practices:
- Use clear and accessible language that a wide range of citizens can understand
- Define and communicate clearly what personal data will be collected and for which purpose
- Be transparent and accurate on who will have access to this data and who the data will be shared with, and why
- Disclose how long the data will be stored for
- If possible, give users the option to use the service even if they are not willing to share all information (put take into account if this might cause a disadvantage for both users opting in and opting out)
- Explain which measures you are going to take to protect their data
- Explain the process through which citizens can access, change or delete the data that is collected
- Explain who the point of contact is in your institutions for any questions citizens might have related to privacy and data protection
You can have that information always retrievable on the website, service, application you are offering.
Slide 7: Good practices
Get some inspiration for asking for consent in an innovative way here:
Or here to see new ways how to present terms & conditions: https://terms.projectsbyif.com/