2

How can the data processor who collect personal information using an online form prove that the person who entered her data gave active consent, for instance by clicking a checkmark?

Imagine a a registration form, where the user enter her information, and those are sent to and stored in a database. The data processor can see that the bit of data corresponding to the opt-in is there (e.g. the value in column consent in the table submissions is TRUE for the given entry). But how to tell if that is there because the user actually performed some kind of actions or not?

Using only the information in the database, that is technically not provable. Or am I missing something?

  • Are you looking for a legal standard for what would be provable in court? If so what jurisdiction? – Jason Aller Apr 26 '18 at 15:20
3

You are missing something.

The fact that you have a tick box and its state is saved in the database is enough. The burden of proof is only "on a balance of probabilities", so someone arguing that they didn't consent would have to demonstrate that you falsified the database entry somehow.

In terms of GDPR requirements in general you don't need a greater level of proof than this, the key thing is that you have a robust system in place to obtain proof (such as not allowing data into the database without a tick in the box).

  • Actually, just not allowing data into the database without the box being ticked might be a violation of the GDPR, since opting in may not be mandatory. – NieDzejkob Aug 8 '18 at 23:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.