GDPR and online forms: how to prove that the data owner opted in?

Question

How can the data processor who collect personal information using an online form prove that the person who entered her data gave active consent, for instance by clicking a checkmark?

Imagine a a registration form, where the user enter her information, and those are sent to and stored in a database. The data processor can see that the bit of data corresponding to the opt-in is there (e.g. the value in column consent in the table submissions is TRUE for the given entry). But how to tell if that is there because the user actually performed some kind of actions or not?

Using only the information in the database, that is technically not provable. Or am I missing something?

Answer 1

You are missing something.

The fact that you have a tick box and its state is saved in the database is enough. The burden of proof is only "on a balance of probabilities", so someone arguing that they didn't consent would have to demonstrate that you falsified the database entry somehow.

In terms of GDPR requirements in general you don't need a greater level of proof than this, the key thing is that you have a robust system in place to obtain proof (such as not allowing data into the database without a tick in the box).