If I have concurrent user consents then can I combine these consents?

Question

I have an app that supports concurrent user consents.

Assume that I have:

1. Consent A that gives access to https://example.com/resources/a
2. Consent B that gives access to https://example.com/resources/b.

But at some point my app needs access to these both: https://example.com/resources/a and https://example.com/resources/b. In a such situation, is it legal to combine these two consents and get access to these 2 resources or I need to get consent which immediately says that user has consented these 2?

I know it seems trivial: user gave consent so you have legal access.

But remember: these consents could be given independently of each other, they can refer to different resources (e.g. health and payment service), and could be given at completely different time.

Answer 1

GDPR consent does not apply to resources or activities, but to processing purposes – to the reason why you are using some data. Also, while consent must be specific, it is not necessary to tire the user with technical details – as long as they are able to consent to one purpose while being able to decline consent for unrelated purposes. And in many cases, no consent is needed at all. In particular, you won't need GDPR consent for processing activities that are strictly necessary to fulfil a contract. (But you do likely need explicit consent for dealing with health data.)

Here, I would think about what those separate and combined processing purposes are, whether they even need consent, and if so when and how you should seek that consent. In particular, an authorization grant for a health data endpoint does not equate GDPR-consent for using this health data for another purpose, and consent for a specific processing purpose could imply authorization for multiple endpoints.

In this sense, yes, it can be legal to “combine consent”, but it massively depends on the specific context of this app – and taking that context into account would be lega advice that can't be given here.