Published on LinkedIn, 7 February 2019.
Same as with Article 5, an article-by-article analysis of the GDPR from an ethics point of view need not go further than the first sentence when it comes to its Article 6: “Processing shall be lawful only if and to the extent that […] the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.
Consent is most likely the first thing any newcomer in data protection learns when it comes to the lawfulness of personal data processing. It is by far the most preferred and discussed about legal basis for the processing, far exceeding all others otherwise listed on par under the same Article 6.
However not any type of consent will do. People really have to both mean it and be able to do so when they consent to their personal data being processed: Hence the analytical description in Article 4: “Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes”.
Here are, then, the conditions under which one lawfully consents. Most of them are straightforward enough, despite tricky legalistic interpretations thrown at them from time to time (see, for example, the opt in/opt out saga).
However, the first condition does stand out, at least from an ethics perspective: When do people give their consent freely?
The automatic reply to that question would be, when they are free. However, this begets the most difficult question of all: When is one free?
Obviously, this is a vast subject: In essence, freedom (or liberty, if you prefer) and the way it has been interpreted from time to time in western civilisation is nothing less than the very basis upon which the life each one of us lives today is built.
At any event, if one for the purposes of this analysis wishes to somehow navigate this topic the first step would be try and go beyond the all too obvious freedom of choice level. One is not necessarily free when he or she is free to choose this over that because, simply put, how he or she got there and the way he or she is thinking while making the choice matters.
Not wishing to re-invent the wheel, I find Santayana’s words most relevant here (but a 4-min read on how Kant thought about this would do no harm either): “There is a fine theory of Hegel that the universe exists in order to realise freedom. In Oriental despotisms, he tells us, only one man was free. In ancient republican cities a minority, the aristocracy of citizens, obtained freedom. Now at last freedom has extended to all; not, however, as we might fondly suppose, in free and casual America, but under the perfect organisation of the Prussian monarchy. For freedom in the mouth of German philosophers has a very special meaning. It does not refer to any possibility of choice nor to any private initiative. It means rather that sense of freedom which we acquire when we do gladly and well what we should have to do anyhow […] German freedom is like the freedom of the angels in heaven who see the face of God and cannot sin. It lies in such a deep love and understanding of what is actually established that you would not have it otherwise; you appropriate and bless it all and feel it to be the providential expression of your own spirit. For liberal freedom, for individualism, these philosophers have a great contempt”.
There you have it then in a nutshell: Individualism and liberal freedom against the heavyweights of German philosophy. If you add a bit of socialism to the mix, without of course forgetting Christian dogma, and then stir it up to reflect a few centuries of political strife and bloodshed that included a couple of world wars, then you end up with the average European mentality today.
Within this framework, when one is or at least feels free?
Or, for data protection purposes, how can one really tell when consent is indeed freely given?
This is not a purely theoretical exercise.
To begin with, I believe that the above, Prussian, mentality according to which one should“freely consent” to certain types of personal data processing is behind the other five legal bases of Article 6 of the GDPR: performance of a contract, legal obligation, legitimate interest, vital interest, public interest.
This leaves consent to be viewed under the individualistic, liberal lens: In its simplest form, indeed “freedom of choice” (“real choice and control”). Under this lens each one of us is perceived as a free agent to act. It is here that personal desires and preferences come in: One is free to choose whether to consent or refuse any of his or her personal data being processed by third parties.
Philosophical theory is nice but reality rarely, if ever, concurs. If people were indeed free to enter or not social relationships (among which, personal data processing) then humanity would not have developed elaborate legal systems to correct the imbalances of human life and protect individuals (through which legal systems the Prussian model comes, through the back door, back to the fore).
In essence, choosing can never be really free, because it is dependent on too many parameters: How one was educated, how much he or she knows, what information he or she has for this particular choice, where he or she lives, with or without a family, etc. Assuming absolute freedom of choice means ignoring the realities of human life.
Apparently legal practitioners cannot get involved in all of this. Lawyers pride themselves in providing practical solutions to complex social problems. This is why compromise on consent in the GDPR has been struck as to freedom being assumed present if there is not a so-called asymmetry (or imbalance) of powers.
Now, to a lot of people this probably sounds even more theoretical: When is there such an asymmetry of powers?
While asymmetry can be imagined in teacher-student, officer-soldier or guard-prisoner relationships, where a clear hierarchy is necessary, is there really an asymmetry between an employer and an employee relationship within a free market? Or, even within a criminal investigation (in a democratic society) when the defendant has “lawyered-up”?
Or, a contrario, is there “symmetry” in me deciding whether to register for a supermarket loyalty card or not, knowing that my choice will ultimately cost me (some) money, that I may need, or like, a lot?
And, at an even more abstract level, who’s to say where there is symmetry and where asymmetry in any human relationship? The Prussian legislator, perhaps?
On the other hand, I would not go as far as to ask for consent to be abolished altogether from the GDPR. Consent is the conceptual basis upon which our legal system and economy builds. It would simply be hypocritical to accept it in civil and business law but to ignore it in data protection law.
I think therefore that in essence I have a problem with the “freely given” wording itself (also a relic of the 1995 Directive). As included in the GDPR it reads to me more of a high-handed intervention, whereby what should be protected is known and visible only to a higher authority, rather than a true call to human freedom. As such, I think it could have been safely omitted, perhaps replaced by the specific criteria identified by the Article 29 Working Party (conditionality, granularity, and detriment).
Consent can never be “freely given” because, simply put, no one is really free in human society – apart perhaps from Diogenes who really tried hard to achieve it. However, for all his efforts Diogenes ended up living like a dog (hence, the cynics), which is exactly the basic requirement for total and complete freedom: A non-human society. For all other cases we will have to make do with varying degrees of freedom, which in turn give us varying-degrees of “freely given consent”, ultimately reflecting the moral boundaries of the society each one of us lives in.