Privacy and apps – consent

In the context of the Master in Data Protection Officer and Privacy Matter Expert, hosted by TopLegal Academy on October 27 in Milan, we addressed a number of topics related to privacy and IT; among others, we focused on topics related to apps, digital and social networks. This week, we will address the main issues that one needs to consider regarding consent in the processing of personal data through apps.

• How should the user’s consent be?

  As required under Article 4 GDPR, consent must be:
  i. freely given: the user has the option to cancel rather than accept the processing;
  ii. specific: the consent is addressed to one purpose only;
  iii. informed: the user must be informed of how his/her data will be processed, prior to the commencement of processing;
  iv. unambiguous: the consent must be undertaken by an action that does not leave any doubt of the user’s intent.
  
  Consent may be prompted through pop-ups and banners

• When is consent usually required?

  To geolocalize the user: a specific consent should be obtained from the user to localize him/her, either only once or on a continuous basis. If the app needs to monitor the user constantly (even on a background activity), evidence of such activity must be shown.
  
  To process special categories of personal data: in this case, an explicit consent must be obtained. It is advisable to use a ‘double phase’ consent (e.g. after providing consent through an online box, the user is required to provide a further confirmation using the code supplied via SMS).
  
  To access the mobile phone’s content, such as its camera or phonebook.

• How to ensure that the user maintains control of his/her data?

  Once the user’s consent is collected, it is important to ensure that the data subject is given an easy way to manage his/her consent. For instance, the app can provide the user with a list of FAQs that address the main issues: how to exercise privacy rights and what are the processing for which a consent has been provided or may be provided. In addition, it is advisable to supply the user with a dashboard to allow for easy and fast management of his/her preferences related to the processing of data.

• What if an app requires the user’s consent for additional and new processing? 

  It is necessary to provide the user with an updated information notice that describes the new processing. In addition, consent must be obtained from the user: it must be clear to him/her that this consent is optional and only related to the new processing (not affecting services already provided through the app).

Please do not hesitate to contact our TMT team should you have any further query.