Can a data controller change their privacy policy without explicit consent?

Question

While I read one of the updated privacy policies (PP) this week, the following section of a privacy policy seemed… off:

We may change this Privacy Policy from time to time, and all changes will be effective at the time we post them. If we believe there is a significant change to this Privacy Policy or our data collection and use practices, we will indicate on our websites that our Privacy Policy has changed prior to the change becoming effective.

While the website indication is probably enough if I'm an active user, this service stores account information, and I might not visit it for a long time and therefore miss the indication on the website. If the new PP now contains a section that allows third parties to use my data I might notice that too late.

For simplicity, this question concerns data that was already stored when a privacy policy changed, not newly acquired data afterwards.

Is a change of a privacy policy without explicit consent valid under the GDPR? If I understand Article 6 (1) a) correctly, the PP must not add change the purposes a data subject has given consent to, unless at least one of Article 6 (1) b)-f) holds.

(This is related to terms-of-service changes without notice, which, at least in Germany, are only allowed if the possible causes where explicitly listed, as far as I know).

Answer 1

The consent presented in the question is a text-book example on how to not secure consent under the GDPR. The GDPR requires concent to be explicit, specific, freely given, and informed. This particular privacy policy does not measure up to any of these requirements.

The GDPR goes to great lengths to regulate consent. For instance, in Article 7 (2) is says:

Any part of such a declaration [of consent] which constitutes an infringement of this Regulation shall not be binding.

So if the consent obtained is not explicit, specific, freely given, and informed, and the company relies on consent to ensure lawfulness of processing, it is breaking the law (and may be fined under the GDPR).

The big problem with this privacy policy is this sentence:

Your continued access to or use of any of the Services shall be deemed your acceptance of the Privacy Policy.

As you've noted, the GDPR requires consent to be explicit. What "explicit" means is spelled out in Recital 32, which (among other things) says:

Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

And Recital 32 goes on state that consent must be specific:

When the processing has multiple purposes, consent should be given for all of them.

The full privacy policy lists 16 different purposes for which personal data is collected, but do not seek specific consent for any of them.

Consent under GDPR must also be freely given. Recital 42 says (among other things):

Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

Here the company states that continued use of the service "shall be deemed your acceptance". The only way the data subject can refuse consent is to not use the service, which is to the detriment of the data subject. This also makes the consent invalid.

Finally, the GDPR also requires consent to be informed. What this means is spelled out in Recital 42, which (among other things say):

For consent to be informed, the data subject should be aware at least [...] the purposes of the processing for which the personal data are intended.

Here the data subject is supposed to consent to some unknown, future change which may be to allow different purposes of the processing. This also invalidates the consent.