Can I rely on consent to process personal data in an AI system?

Answered

Only if you have a direct relationship with the people whose data you process, and consent is freely given, specific, informed, unambiguous and shown by a clear affirmative act. People must have a genuine choice. Consent is often hard to rely on for public services where people cannot reasonably refuse. For solely automated decisions under Article 22, explicit consent is one of the three permitted conditions — and still needs the extra safeguards.

From the guidance

Primary (how) ICO: How do we ensure lawfulness in AI?

Consent may be an appropriate lawful basis in cases where you have a direct relationship with the individuals whose data you want to process. However, you must ensure that consent is freely given, specific, informed and unambiguous, and involves a clear affirmative act on the part of the individuals. For consent to apply, individuals must have a genuine choice about whether you can use their data.

Section: Can we rely on consent?

Read this in ICO: How do we ensure lawfulness in AI? (opens in new tab)

Secondary (normative) ICO: Article 22 of the UK GDPR and fairness

You can only carry out this type of decision-making where the decision is: necessary for the entry into or performance of a contract; authorised by law that applies to you; or based on the individual’s explicit consent.

Section: What is the purpose of Article 22?

Read this in ICO: Article 22 of the UK GDPR and fairness (opens in new tab)

Related questions