One of the conditions for processing both personal data and sensitive personal data is consent.

Consent does not make the processing lawful of itself - there must still be a lawful reason for the processing.

The definition of consent is not set out in the Act but is derived from the Article 2(h) of the European Data Protection Directive 95/46/EC which states:

the data subject's consent shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.

Consent can be achieved if it has been freely given for a specific purpose and to which the individual, having been informed of the purpose, signifies agreement.  It should be presented prominently and not hidden behind the veil of a long and complex privacy policy or fair processing notice.

In relation to sensitive personal data, consent must also be explicit and absolutely clear.

Some form of active communication is required. Consent cannot be inferred from a non-response.

Consent can be obtained by the use of a fair processing notice coupled with an appropriate response.  

Consent can be withdrawn at any time and the act of withdrawing consent should be as simple as providing it. Therefore in terms of meeting a condition for processing, consent should only realistically be relied on as a 'back stop' in circumstances when no other condition can be met. 

The Commissioner has issued an advice note regarding consent which can be found at the end of this page.