Higher Standards of Consent under the Act on Providing Services by Electronic Means
In the Act on Providing Services by Electronic Means (uśude), there are two types of consent – consent for the transmission of commercial information (Article 10(2) of uśude) and consent for the processing of data other than that necessary for providing the service by electronic means, for the purposes of advertising, market research, and the behaviors and preferences of service recipients, with the results of such research intended to improve the quality of services provided by the service provider (Article 18(4) of uśude). In this second case, the service provider must now clearly indicate which data are not necessary for the provision of services (Article 18(3) GDPR).
Receive a package of free GDPR guides and micro-training sessions
- voluntary – it should not be a condition for providing the service or fulfilling the contract, and its withdrawal should be as easy as its expression,
- specific – it should relate to the processing of data for a precisely defined purpose (e.g., sending a newsletter). In the case of multiple purposes (e.g., marketing of own and third-party products), separate statements should be obtained. Too general a formulation of consent was one of the main reasons why the French supervisory authority imposed a fine of 50 million euros on Google,
- informed – the data subject should know at least the identity of the data controller, the purpose of processing, and the type of data before giving consent, be aware of whether automated decision-making will occur based on the data, and whether the data will be transferred outside the European Economic Area, as well as be informed about the possibility of withdrawing consent,
- unambiguous – expressed in the form of a statement or action clearly indicating its provision. Consent cannot therefore be implied.
Example of Unambiguous Consent
“Sliding a bar on the screen, waving in front of a smart camera, rotating a smartphone clockwise, or drawing an eight may be variants of expressing consent, provided that clear information is given and there is no doubt that the given movement signifies consent in response to a specific request.”
Example of Implied Consent
“Scrolling down or browsing a website does not meet the requirement for an explicit and confirmatory action. This is due to the fact that a warning indicating that continuing to scroll will be considered as consent may be difficult to distinguish and may be overlooked.”
Source of examples:
Article 29 Working Party, guidelines on consent under Regulation 2016/679 (17/PL WP259 rev.01), adopted on November 28, 2017, last amended and adopted on April 10, 2018, p. 19.
Analogous Changes in Telecommunications Law
The conditions for consent described above also apply to Telecommunications Law. Consent for the use of telecommunications terminal equipment and automatic calling systems for direct marketing purposes must also comply with the requirements of the GDPR, as indicated by the new wording of Article 174 of the Telecommunications Law. This means, among other things, the obligation to obtain separate consent for each specific communication channel (e.g., SMS, email).
Interestingly, penalties for violations of the GDPR resulting from the improper application of the provisions of the Telecommunications Law are imposed on providers of publicly available telecommunications services by the President of the Polish DPA (Article 210a of the Telecommunications Law). In other respects, sanctions for violations of the Telecommunications Law are applied by the President of the UKE.
Easier Compliance with Information Obligations for Micro-Entrepreneurs
As indicated by the changes in the Consumer Rights Act, in the case of contracts with consumers – concluded both on the premises and outside the business premises and at a distance – a micro-entrepreneur may limit themselves to providing the GDPR privacy notice on their website or at the business premises – without actively delivering it to each customer.
The above exception does not apply when the entrepreneur processes special categories of data, i.e., data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in trade unions, genetic data, biometric data, or data concerning health, sexuality, or sexual orientation.
