- This card represents the law pre-GDPR implementation and is being updated but for up-to-date information please see our summary GDPR card here
- An employer may wish to rely on a worker’s consent in order to satisfy the requirement in the first data protection principle in the Data Protection Act 1998 (the “DPA”), Schedule 1, Part 1, that personal data must be processed fairly and lawfully.
- The meaning of consent under the Regulation of Investigatory Powers Act 2000 is the same as the meaning under the DPA.
- The meaning of ‘consent’ under the DPA is intended to be the same as the meaning under the EC Data Protection Directive (95/46/EC). The EU Article 29 Working Party has issued an Opinion on the meaning of consent which is followed by the Information Commissioner.
- The Information Commissioner’s view is that consent alone should not be relied on to legitimise processing of personal data and that blanket consent obtained at the outset of employment cannot always be relied on.