The validity of consents to the processing of personal data obtained so far under the Personal Data Protection Act will remain legal if it meets the criteria contained in the GDPR. As shown directly from the recital 171 Regulation (EU) 2016/679, of 27 April 2016, on the protection of personal data relating to the processing of personal data and on the free movement of such data and repealing Directive 95/46 (GDPR: “If processing is based on consent according to Directive 95/46, the data subject does not need to give his or her consent again if the original form of expression corresponds to the conditions of this Regulation; thus the controller may continue processing after the date of application of this Regulation.’
This means that the consent to the processing of personal data obtained under government Directive 95/46, does not lose its validity. However, make sure that the consent expressed by a natural person so far meets the requirements set out in the GDPR, i.e. meets the following criteria.
If the processing is based on consent Directive 95/46, the data subject does not need to give his or her consent again if his or her original expression meets the conditions of this Regulation.
Please note that, in accordance with the principle of accountability, the personal data controller will have to demonstrate the correctness of all previously collected consents. The correctness analysis should demonstrate that consent to the processing of personal data obtained from individuals meets the criteria:
- •
- voluntary (possibility of real and informed choice, no negative consequences in the absence of consent),
- •
- specificity (precise definition of the purpose and scope of the processing of personal data; the consents collected so far should be clearly identified by the data controller and the purpose of the processing of personal data),
- •
- awareness (before obtaining consent, the necessary information should be provided to data subjects to enable them to make informed decisions and understand what they agree to),
- •
- unambiguousness the data subject must take deliberate action to give consent to the specified processing; the existing consents cannot be implied by statements of other content, silent or by default marking the windows by the service provider).
According to the above, administrators who process personal data on the basis of the consent expressed under the Personal Data Protection Act do not have to automatically obtain all consents again, because the declaration submitted to date remains valid, insofar as it meets all the requirements which the GDPR formulates.
Author:
Emilia Pasławska
Legal advisor at the Legal Department Graduate of the Faculty of Law and Administration at the University of Gdańsk and Postgraduate Tax and Tax Law Studies at the University of Warsaw. In 2016 She completed an advisory application at the District Chamber of Legal Advisors in Warsaw, then passed the bar exam with a positive result.
She gained her professional experience in the Tricity and Warsaw law firms, conducting legal services for natural and legal persons. He also has professional experience in representing clients before general and administrative courts. Her interests focus on civil and economic law.