17

If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?

  • 3
    Are you suggesting that you "open source" your personal data? – Mawg Aug 28 at 19:22
  • 8
    selectively in this thought experiment, yes :-) – J. Doe Aug 28 at 19:49
  • This question should be re-posted at philosophy SE. – rexkogitans Aug 29 at 12:12
  • You are free to publish your data. This has nothing to do with what the law says about which requirements service provides have in the case where you specifically give the data to them to get a service. They could implement the service without asking you the data and scraping it from your website where you license it publicly. Problem is most people don't do that and it costs time & money to do, so why would they spend money to implement this case instead of just uniforming the process and handle your data with care? – Giacomo Alzetta Aug 29 at 13:52
  • The answer to your question is clearly "yes". It just doesn't mean anything. You can declare whatever you want (of course). What matters is whether people hear you and whether they care. Right? – Apologize and reinstate Monica Aug 29 at 16:03
26

You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are already allowed to because of the exceptions, they have to - under GDPR - assume you don't want them to process your data, and thus have to ask you.

  • 6
    Consent is only one of the bases for processing; if the data processor is using legitimate interest (for example) as the basis for processing the individual's data there's no requirement to gain consent first. – Ben Aug 28 at 22:49
  • 5
    @Ben: You're not wrong but those cases are irrelevant for the question at hand, which focusing on pre-emptively giving consent. Cases where no consent is needed are not part of the problem domain. – Flater Aug 30 at 13:49
14

2016/679 ("GDPR") defines the responsibilities of data processors and controllers (subject to the scope of the legislation). An individual can declare whatever they like, but those processors and controllers will still be bound by the legislation.

In many cases consent will be irrelevant - it's only one of the lawful bases for processing :

(a)

the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b)

processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(c)

processing is necessary for compliance with a legal obligation to which the controller is subject;

(d)

processing is necessary in order to protect the vital interests of the data subject or of another natural person;

(e)

processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f)

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

A natural person could declare that anyone could use their data, or that no one could, and the processors and controllers would still be bound by the legislation. It's possible that they could use that declaration to demonstrate lawful basis (a) but, as Trish mentions, only if they knew that the declaration had been made and only if the process pointing them at the declaration complied with paragraph 32 :

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

It's difficult to see how a generic statement with no other context could meet the "specific" and "informed" part of that paragraph.

If they were relying on one of the other lawful bases for processing, the declaration wouldn't change anything.

To answer the original headline question, 2016/679 doesn't mean anything to a natural person in respect of their own personal data except when exercising their rights under Chapter III. It becomes more relevant when handling data relating to someone else.

[Edit after NotThatGuy's amendment to the headline question, which makes the answer simpler : Not under GDPR, as the data subject wouldn't have been "informed" of the "specific" nature of the "proposed processing" - see paragraph 32.]

10

You can't make a binding declaration

If you wish, you can make a public declaration that you grant consent for any and all processing of your data. You would likely have to be more detailed than that (consent needs to be informed and specific) - you'd likely have to exhaustively specify that yes, you know that this includes also this and that specific purpose and particular protected data (e.g. Article 9.1 and 9.2(a) regarding special categories of data), and that declaration of consent would need to demonstrate that it's informed consent e.g. that you're aware of potential consequences and risks; but in general if the controller can demonstrate that you consented to the processing, that should be sufficient according to article 7.1. They would have to identify you somehow, though - if someone posts on the internet "I, John Doe, consent to all processing" then you'd still need some reasonable assurance that it's actually John Doe who published that instead of their prankster buddy.

However, you can't make a binding, irrevocable consent - according to GDPR (Art. 7.3), you have the right to withdraw that consent at any time; and if you'd find a loophole that would result in a situation which effectively allows a data processor to prevent you from withdrawing that consent, then that would generally (subject to interpretation by the local DPA) not count as freely given consent any more - and consent that's not freely given is not lawful basis for processing data.

So companies still have to expect that at any time you have the right to change your mind, withdraw the consent, request all the data they have on you, request deletion where appropriate, etc.

  • The points regarding it being binding and irrevocable are not relevant to the question. If you think about it, they apply equally whether the OP gives his consent on a case by case basis, or makes a declaration. The question is only about whether a declaration is possible. The OP is not asking whether he can make the declaration in such a way that he can never revoke it. – JBentley Aug 29 at 0:29
  • @JBentley this is relevant to the question part "without asking myself every time" - this means that someone finding such a public declaration somewhere can't assume that this has not been revoked since, so this puts a restriction on how such a declaration would have to be published (in a way that it makes reasonable to assume/verify that the issuer still intends to be valid) in order to be usable by anyone. As in the other points, making a declaration is trivial, but making a declaration in a manner that would actually satisfy the compliance needs of all potential data processors is tricky. – Peteris Aug 29 at 7:21
  • I would suggest you mention that in the answer. The way it reads now, it isn't clear that you are referring to the lack of certainty over the original declaration – JBentley Aug 29 at 21:15
3

As others have pointed out, the problem is that the information holders need to know that you've given this universal consent.

Theoretically, some organization could manage a central database, where anyone who wants to make such a declaration is recorded, and information holders could check this before asking you for constent explicitly. But this would then require some kind of universal identifier for everyone, or at least those people who would like to take advantage of this service.

Facebook is becoming so popular (about 28% of the world population use it) that it could conceivably provide this kind of service (think of all the sites that let you login by linking with your FB account). But considering all the privacy concerns with Facebook, would you really want them managing the data that other organizations use to manage privacy?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.