When the General Data Protection Regulation was unleashed, one element that caught the imagination of some (particularly those involved in marketing) was a perceived concession around consent. Although consent for ordinary, non-sensitive data needed to be unambiguous, freely given, specific, informed and demonstrable, although the recitals made clear that silence or an opt-out could not be interpreted as consent, there was relief that ‘explicit’ consent was not required in ordinary circumstances. Only for sensitive data (or what the GDPR calls ‘special categories’) would ‘explicit’ consent be needed.
Phew. I mean, it’s good news, right? You’re going to have show that the person knew exactly what they were agreeing to, you’re going to need a positive indication, an identifiable sign of active agreement, you’re going to need to demonstrate that the consent was solicited separately and clearly from other guff in terms and conditions that you might be throwing at them, and you’re going to need to be able to demonstrate that consent was obtained in these circumstances. But it doesn’t have to be explicit, so that’s OK. At least we don’t have to go that far.
Allow me to put my cards on the table. I think it’s nonsense. There is no difference. There is nothing extra signified by ‘explicit’ that is not already required by the other, ostensibly lower threshold. Someone asked me recently whether ‘explicit’ means written, and maybe that’s the difference. But if you ask me a clear question – can we use your sensitive data for this purpose, and I respond clearly but verbally ‘Yes, Yes you can’, how is this not explicit? I think explicit is just a word (it’s one of the words you find in the dictionary to define ‘unambiguous’), and the threshold for non-sensitive consent is as high as it can be.
But it isn’t enough for me to assert this. I would like to test my theory, and this is where you come in. Welcome to the first 2040 Training Vaguely Trolling Data Protection Competition.
Yes, it’s a real competition, and yes, there are real prizes. This is how it works.
The Challenge
The challenge is to explain the difference between unambiguous and explicit consent, but you must use real examples – you don’t have to actually have done it, but I don’t want a theoretical explanation of the difference. Entrants must send in two examples – the first must describe a situation where a person gives unambiguous consent, meeting the requirements of the GDPR. Then, entrants must submit a second description of a situation which is clearly different from their first example, illustrating how the second example is explicit, rather than simply unambiguous.
How to Enter
Send your entry by email to explicit.yes.indeed@gmail.com, together with your name, with the two examples clearly marked: “Unambiguous but not Explicit” and “Explicit“. You must use practical examples, but you can illustrate your entry with explanations of why you think the two are different. There is a word limit of 1000 words in total.
Any queries about the competition and how it works should be sent to the above address.
The Prizes
The winner, who successfully demonstrates the difference, will receive £200 cash.
All entrants (except the £200 winner) will be put into a random draw to win a copy of my favourite books published in the information rights field in recent years: Matt Burgess’ invaluable guide to the Freedom of Information Act, and the incendiary Blacklisted by Dave Smith and Phil Chamberlain. If you don’t enter the competition, or you do and you don’t win, you should buy these books and read them. NB: the book’s authors have not endorsed this competition and I reserve the right to substitute different books if they tell me to.
The Judging
I will read all entries and shortlist a maximum of five that constitute the best attempts at the challenge. The shortlist will then be considered by the expert judging panel of myself, and the unquestionably more respectable Scott Sammons and Jon Baines. The winner will be selected as best illustrating the difference between the two. In the event that no entry successfully differentiates between unambiguous and explicit consent in the opinion of the judges, each shortlisted entrant will receive a consolation prize of £30, but the £200 will not be awarded. If the £200 prize is awarded, the shortlisted entrants go into the book draw with everyone else.
Any entry that does not fulfil the basic conditions of entry (i.e. an entry that includes two different examples of consent, even if that entry fails to convince the judges) will not be entered into the random draw for the books. The draw for the books is for everyone who takes on the challenge; you can fail to make the shortlist and still win the books as long as you have a go.
The Closing Date
Entries must be received by 30th June 2016.
The Rules
- The competition is open to residents of the UK and the Republic of Ireland.
- An entry can be a sole or joint effort, but any entry that comes from a group will receive a single £200 or pair of books if their entry is successful or their name randomly drawn.
- No purchase is necessary.
- All submissions will be read and considered, and entries are welcome from interested members of the public, data protection officers, consultants, lawyers, current and former members of ICO staff, armchair auditors, and anyone with whom I have a current or historic feud.
- Entrants’ personal data, including contact details, will be used solely for the purposes of the competition and will not be retained after the prizes are awarded. No marketing or other correspondence will be sent.
- The winner will be announced on the 2040 blog no later than 31st August 2016, and winners will be contacted afterwards to arrange delivery of the prizes.
- Entries must be submitted in English and in an electronic format. Entries can be submitted in a non-written format (e.g. sound recording) but please contact me first to ensure successful delivery of your entry.
- Copyright for entries is retained by entrants and entries will not be reused for any commercial purpose, but it is a condition of entry that shortlisted entries and the names of shortlisted entrants can be published wholly or in part on the 2040 blog or 2040 website, credited to the author.
- Entries that do not make the shortlist will not be published or referred to in any form without the entrant’s unambiguous consent.
- If no entry successfully differentiates between the two types of consent to the satisfaction of the judging panel (i.e. at least two judges do not think there is a successful entry), the £200 prize will not be awarded. There is no requirement for entries to be well-written or interesting – the sole criteria on which entries will be judged is whether, in the opinion of the judges, the entrant has successfully demonstrated the difference between the two versions of consent.
- In the event that the judges cannot reach a verdict on several entries that successfully demonstrate the difference, they will randomly draw the winner.
- If two of the three judges believe that one of the shortlisted entrants has met the terms of the challenge, the £200 prize is awarded even if the third disagrees.
- The draw for the books will take place after the judging, and will include all entrants, except the £200 winner.
- An independent third party will draw the winner of the books from a hat.
- It’s a real hat.
- The judges’ decision is final.