Box 13
- 1. Box 13. Examples of user consent laws Where the personal data being processed is special category data (for example, biometric data), The EU’s GDPR specifies that additional conditions must be satisfied, one of which is obtaining the individual’s “explicit” consent to the processing (GPDR Article 9). It is not clear whether there is a difference between standard consent and explicit consent (since standard consent must be specific, informed and affirmative action). However, given the GDPR has only been implemented recently it is likely that further guidance will be issued to clarify this. The California Consumer Privacy Act of 2018 applies to certain businesses that collect personal information of California residents and will go into effect in 2020. The Act, unlike the GDPR, does not strictly require consent prior to collection of personal information, in most cases. However, at the point of information collection, consumers must receive notice “as to the categories of personal information to be collected and the purposes for which the categories of personalinformation shall be used” (Cal. Cov. Code §178.100(b). Additional information must be disclosed in an online privacy policy or a website and updated every 12 months (Cal. Cov. Code §178.130(a). In Australia, the federal Privacy Act 1988 (as amended) contains as one of its “Privacy Principles” the rule that personal information about an individual collected for a particular purpose must not be used or disclosed for another purpose without the individual’s consent. However, there is an exception for situations where the use or disclosure is “reasonably necessary” for the enforcement related activities conducted by or on behalf of an enforcement body—which includes use or disclosure by police for prevention, detection, investigation, prosecution or punishment of criminal offences—as wellas an exception for uses and disclosures authorized by law or by court order. Use for enforcement related activities must be noted in writing as a mechanism to promote accountability. (See Section 6 of the Privacy Act, Schedule 1 clause 6 of the Australian Privacy Principles, and also Privacy Act reforms – implications for enforcement functions) Source: Adapted from the ID Enabling Environment Assessment (IDEEA).