When is it possible to process personal data?
Consent
The processing of personal data can generally always take place if you have given consent as a specific statement or as a unambiguous confirmation. A statement can be oral, written or electronic. A unambiguous confirmation can be for example by answering an online questionnaire.
In order for consent to be valid, it must be voluntary, specific, informed and unambiguous. This means, among other things, that consent:
where it is not possible to grant a tacit consent. consent must always be granted through an action, such as tapping a field.
must be specific and define the information collected and for what purpose. It must not collect information other than that which is necessary.
it must be clear that you have given consent and for what processing.
there must be no unnecessary negative consequences of not giving consent.
You always have the right to withdraw consent. It should be as easy to withdraw consent as it is to grant it.
Consent is therefore not always the appropriate authority for the processing of personal data:
The government generally cannot rely on your consent to processing personal data about you, but rather relies on legal authorizations.
Employers also generally cannot rely on their employees’ consent, as there is rarely a non-conscriptive consent.
If the processing of personal data is initiated on the basis of consent, it may only be processed for the purpose for which consent was obtained.
Read more about consent in (pdf in Icelandic)
The term consent is used more widely in legal terms than in data protection laws. Other laws may have different definitions and requirements for validity. If the processing of personal data is based on consent, it is important to meet the conditions for data protection consent.
Legal consent that does not relate to personal protection is used for example within the healthcare system or social affairs. This is often referred to as processing where consent is not the basis for processing, but has been chosen by law or other rules to give the individual the opportunity to object to processing.
