C – Explicit consent ((a))
Art. 9(2)(a) GDPR – When and how consent allows the processing of sensitive data, and what to bear in mind.
Back to the Art. 9 GDPR overview | C. Exceptions – overview
At a Glance
Art. 9(2)(a) allows the processing of sensitive data where the data subject has given explicit consent. This is a stricter form of consent than the regular consent under Art. 6 – mere silence or a pre-ticked box, for example, is not sufficient.
Conditions: What must consent fulfil?
For consent to be valid, all five conditions must be met:
- a) Freely given – the person must not be under pressure and must not suffer disadvantages if they refuse
- b) Informed – the person must have been fully informed in advance: what is processed, for what purpose?
- c) Specific – consent must relate to specific purposes and specific data categories
- d) Explicit – consent must be declared actively and clearly; not by silence or agreement to terms and conditions
- e) Withdrawable – consent must be withdrawable at any time without any disadvantage
I. What "explicit" means
The word "explicit" is the key difference from regular consent under Art. 6. Explicit consent is given where the person:
- actively and explicitly consents to the processing of sensitive data
- unmistakably refers to precisely those sensitive data and the purpose of their processing
- declares consent in writing, electronically or orally (all forms allowed, but it must be demonstrable)
What is not sufficient
- Pre-ticked boxes
- General terms and conditions clauses without separate emphasis
- Tacit acquiescence to processing
- A single tick covering many different purposes
II. Particular caution in the employment relationship
In the employment relationship, freely given consent is often doubtful: someone who does not want to lose their job will easily agree even if they actually do not want to. Special requirements therefore apply here – consent is only valid if special circumstances allow a genuinely free decision.
III. Withdrawal of consent
The data subject may withdraw consent at any time. Withdrawal applies for the future – what was lawfully processed before remains lawful.
Consequences of withdrawal:
- The data must be erased without undue delay
- All ongoing processing must be stopped immediately
- Recourse to other legal bases is not possible insofar as those bases require consent
IV. Practical relevance
Explicit consent is particularly important in the case of:
- Apps and digital services that use sensitive data
- Marketing and profiling with health or origin data
- Membership management in associations with a religious or political background
Note: In some areas – e.g. genetic testing under the Gendiagnostikgesetz (Genetic Diagnostics Act) – German law sets even stricter requirements for consent. In such cases, those stricter requirements apply.
Frequently Asked Questions (FAQ)
Can I simply have a tick set? No – not if it is pre-ticked. The tick must be actively set by the person themselves.
How must consent be documented? It must be demonstrable. Written or electronic form is safest. Oral consent is permissible but hard to prove.
What happens if consent was invalid? Then there is no legal basis under Art. 9(2)(a) – the processing is prohibited.
Do I need anything else besides consent? Yes. In addition to consent under Art. 9(2)(a), a legal basis under Art. 6(1) must also be present – usually likewise consent under Art. 6(1)(a).