Your Right to Withdraw Consent
As a data subject you have the right to withdraw your consent at any time, if your data is being processed using consent as the legal basis. In order for an organisation to process your personal data using consent as its legal basis, your consent must be freely given.If there is no way for you to withdraw your consent then that consent cannot be considered to be freely given.
This is stated clearly in the European Data Protection Board’s guidelines on consent: “… consent will not be considered to be free if the data subject is unable to refuse or withdraw his or her consent without detriment.”
Your right to withdraw consent is set out in Article 7 of the GDPR. The full text of this article is at the bottom of this page. We’ve also included the text of Recital 32, which has more information on consent.
Enforcement in action: In November 2019 the Polish data protection authority imposed a fine of around €46,000 on a company for, among other things, failing to respect the right to withdraw consent.
In June 2019 the Spanish data protection authority fined La Liga €250,000 for, among other things, failing to allow users of its app to withdraw consent.
Where next?
Consent is only one legal basis a data controller can use to process your personal data. Read more about legal basis for processing of personal data in ‘Lawful basis: a short introduction’.
Read more elsewhere
1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data. 2. If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding. 3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. 4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract
Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. 3Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
Topics
Data Protection Fundamentals (basics, definitions and more …)
Your Rights (all your data protection rights: access, information, rectification and more …)
In More Detail (explorations and explanations of data protection concepts …)
Keeping Track (tracking Subject Access Requests and complaints to Supervisory Authorities …)