On September 28, 2023, the Office of the Data Protection Commission (ODPC) announced on Twitter, that it had published guidance on consent. In particular, the guidance details the data subject consent requirements under the Data Protection Act, 2019 (the Act).

Conditions for consent

The guidance provides that the Act does not specify the measures data controllers and data processors should implement to ensure compliance with the consent requirements under the Act. However, the guidance states that data controllers and data processors have an obligation to prove that valid consent was obtained from the data subject before processing of their personal data. Further, the guidance notes that data subjects have the right to withdraw consent.

When consent should be obtained

In particular, the guidance highlights that consent should be obtained from the data subject prior to processing of their personal data, and data controllers or data processors must obtain new and specific consent if the purposes for data processing change after consent is obtained.

Consent and other lawful bases

The guidance notes that data processors and data controllers must be consistent in their application of lawful bases for processing and cannot retrospectively rely on a different lawful basis to justify processing. Further, the guidance highlights that when a statutory requirement is applied as a lawful basis for processing, consent should be obtained for any processing that goes beyond what is required under statute.

Finally, the guidance advises data controllers and data processors that consent does not waive their obligations under the Act, and that data subjects would contravene the law if they consent to processing contrary to legal requirements.

You can read the guidance here.