Under the Data Protection Directive, each instance of data processing requires a legal justification – a “ground for processing”. This fundamental feature of EU data protection law remains unchanged under the draft Regulation. However, the bar for showing the existence of certain grounds for processing will be set higher, particularly in relation to consent.
Stringent and uncertain consent rules
For starters, under the draft Regulation, if the data subject’s consent is given in a written document, and that document also concerns other matters (e.g. terms of service), the consent must be presented in a form that is distinguishable from the remaining contents of that document. This will result in the need to review existing contracts, general terms and conditions and other existing documents, in order to differentiate the consent language from the remaining subject matter.