GDPR: the consent should be as easy to withdraw as to give it

The company appealed the decision of 16 October 2020 (ZSPR.421.7.2019) in which the PPDPO stated that ClickQuickNow violated Article 5(1)(a), Article 6(1), Article 7(3), Article 12(2), Article 17(1)(b) and Article 24(1) of Regulation 2016/679. 

The PPDPO emphasised that in designing its consent withdrawal procedure the company not only disregarded the principle that the consent should be as easy to withdraw as to give, but actually went the opposite way – it implemented complicated organisational and technical measures to prevent data subjects from withdrawing their consent with ease.

According to the PPDPO, the investigation clearly showed that ClickQuickNow did not follow its own rules. Contrary to the company’s assurances, clicking on a link included in commercial communication did not result in a quick withdrawal of the consent to personal data processing and the messages which appeared after clicking on the link mislead everyone who wanted to withdraw the consent. The obstacles were so formidable that they made the effective consent withdrawal impossible.

The company groundlessly required anyone who wanted to withdraw their consent to state the reasons for the withdrawal and the withdrawal process could not be completed without providing a reason. To successfully withdraw the consent to data processing users had to read a notice from the company, send their request once again to a dedicated address and describe what exactly they wanted from the company. This practice made the exercise of the right to withdraw consent and to be forgotten essentially impossible, despite these rights being guaranteed by law.

The PPDPO found those practices unacceptable. In his opinion, the company’s consent withdrawal procedure did not meet the criteria of easy and quick consent withdrawal (Article 7(3) and Article 12(1) of Regulation 2016/679). The company’s practice violated the principles of transparency and fairness in the withdrawal of consent by sending contradictory and misleading communications to data subjects (Article 5(1)(a) of Regulation 2016/679). The PPDPO assessed the company’s practice also in light of the right to erasure (the right to be forgotten) and found that it impeded the effective withdrawal of consent (Article 17(1)(b) of Regulation 2016/679). Consequently, the authority ruled that the company processed personal data without the required legal basis (Article 6(1) read together with Article 5(1)(a) of Regulation 2016/679).

The Provincial Administrative Court upheld the PPDPO’s decision and in the statement of reasons emphasised, invoking Article 7(3) GDPR, that the withdrawal of previously given consent must not be made difficult.

The judgment discussed in this article confirms how important it is for the data controller to ensure technical and organisational measures which let data subjects exercise their rights, including the right to consent withdrawal and the right to be forgotten.