IP - 7121-1/2020/369

IP (Slovenia) - 7121-1 / 2020/369
Authority:	IP (Slovenia)
Jurisdiction:	Slovenia
Relevant Law:	Article 6 GDPR Article 7 GDPR Article 8 GDPR Article 13 GDPR
Type:	Advisory Opinion
Outcome:	Other Outcome
Started:
Decided:	20.03.2020
Published:
Fine:	None
Parties:	anonymous
National Case Number/Name:	7121-1 / 2020/369
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Slovenian
Original Source:	Informacijski Pooblaščenec (in SL)
Initial Contributor:	n/a

The Slovenian Supervisory Authority (IP) issued an opinion as foreseen under Article 58(3) GDPR on the issue of the validity of consent to access digital content and online classrooms during the state of emergency in the Slovenia. The IP found that the consent may be given in writing, electronically or in another appropriate manner, and in any case should fulfill the requirements under Article 7 and Article 8 GDPR.

English Summary

Facts and questions arising

Various providers have opened up their digital content to provide free access to this content for students and students, and some are looking to gain access to creating classrooms by groups of students' online addresses.

The IP received a request from the principals whether the consent would be valid if the students gave it electronically via e-mail, and not in the written form, since a handwritten consent cannot be obtained during the pandemic period.

Holding

The IP clarified that under the GDPR consent does not have to be handwritten. According to Article 4(11) GDPR, "consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her". Consent may therefore be given in writing, electronically or in another appropriate manner.

The IP further provided that the validity of consent must be subject to the conditions laid down in Article 7 GDPR.

Additionally, in this case, the IP also reiterated the provisions of Article 8 GDPR on conditions applicable to child's consent in relation to information society services.

Against this background, consent may also be given by electronic means subject to the conditions set out in Articles 7 and 8 GDPR.

It is also recalled that individuals need to be properly informed before giving their consent - they should be clearly informed of what personal data will be processed, for what purposes, about their rights, etc., as required by Article 13 GDPR.

Comment

Share your comments here!

Further Resources

The IP invited to get familiar with more information on their website concerning the provision of information to the individuals ahead of the collection of their consent:

https://www.ip-rs.si/fileadmin/user_upload/doc/vzorci/VZOREC_OBVESTILA_POSAMEZNIKOM_GLEDE_OBDELAVE_OSEBNIH_PODATKOV.docx

More information about the consent:

Infographics: https://www.ip-rs.si/fileadmin/user_upload/png/infografike/pravne_podlage_zasebni_sektor_s_pogoji_privolitve.pdf

Specific Consent Subpages: https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna-podrocja-uredbe/privolitev/

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Slovenian original for more details.

Date: 03/20/2020
Title: Opinion on consent to access digital classrooms
Number: 7121-1 / 2020/369
Subject matter: Information for the individual, Legal bases, Consent, Education
Legal act: Opinion
The Information Commissioner (hereinafter: IP) has received your letter asking us for an opinion on the validity of consent to access digital content and online classrooms during the state of emergency in the Republic of Slovenia. Various providers have opened up their digital content to provide free access to this content for students and students, and some are looking to gain access to creating classrooms by groups of students' online addresses. The principals have contacted you with a question as to whether the consent would be valid if the students submitted it electronically via e-mail, even if they were not signed in their own hands, since the consent cannot be obtained during this time, since it is inadvisable to advise leaving home.
On the basis of the information you have provided, hereinafter referred to as Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and Directive 95/46 / EC (hereinafter: the General Decree), point 7 of the first paragraph of Article 49 of the Personal Data Protection Act (Official Gazette RS, No. 94/07, officially consolidated text, hereinafter ZVOP-1), and 2 Article 43 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, No. 113/05, hereinafter ZInfP), we provide our non-binding opinion on your question.
The IP makes it clear that an individual's consent under the General Regulation is not necessarily a mere handwritten consent. According to Article 4 (11) of the General Regulation, 'consent of the data subject' means any voluntary, explicit, informed and unambiguous statement of the will of the data subject by which he expresses himself with a statement or clear affirmative action consent to the processing of personal data relating to him. Consent may therefore be given in writing, electronically or in another appropriate manner.
The validity of consent must be subject to the conditions laid down in Article 7 of the General Regulation:
1. Where processing is based on consent, the controller must be able to demonstrate that the data subject has consented to the processing of his personal data.
2. Where the consent of the data subject is given in a written statement relating to other matters, the request for consent shall be submitted in a manner clearly distinguishable from other matters, in an understandable and easily accessible form; and in clear and simple language. Parts of such declaration that constitute a violation of this Regulation shall not be binding.
3. The data subject shall have the right to withdraw his / her consent at any time. Revocation of consent shall not affect the lawfulness of the processing on the basis of consent prior to its revocation. The data subject shall be informed before consent. Consent is as easy to revoke as to give.
4. In determining whether consent has been given on a voluntary basis, it shall in particular take into account whether the performance of the contract, including the provision of the service, is conditional on consent to the processing of personal data which is not required for the performance of the contract in question.
As in this case, students are also reminded of the provisions of Article 8 of the General Regulation on the conditions applicable to the consent of the child in relation to information society services:
1. Where point (a) of Article 6 (1) applies, in respect of information society services offered directly to the child, the processing of the child's personal data is lawful when the child is at least 16 years old. When a child is under the age of 16, such processing is lawful only if and to the extent that such consent is given or approved by the holder of parental responsibility for the child.
Member States may stipulate a lower age for this purpose, provided that this age is not less than 13 years.
2. In such cases, the operator shall make reasonable efforts to verify that parental responsibility for the child has given or given consent, taking into account available technology.
3. Paragraph 1 shall not affect the general contract law of the Member States, such as the rules on the validity, formation or effect of a contract relating to a child.
Against this background, consent may also be given by electronic means subject to the conditions set out in Articles 7 and 8 above.
It is also recalled that individuals need to be properly informed before giving their consent - they should be clearly informed of what personal data will be processed, for what purposes, what their rights, etc., as required by Article 13. with the provisions of Article 13 you have on the IP website a form that may be helpful to you - it is appropriate to provide the form properly to the individuals concerned before giving their consent or when they do invites them to give their consent so that they are properly informed of what they are consenting to:
https://www.ip-rs.si/fileadmin/user_upload/doc/vzorci/VZOREC_OBVESTILA_POSAMEZNIKOM_GLEDE_OBDELAVE_OSEBNIH_PODATKOV.docx
You can also find more information about consent in our:
Infographics: https://www.ip-rs.si/fileadmin/user_upload/png/infografike/pravne_podlage_zasebni_sektor_s_pogoji_privolitve.pdf
     Specific Consent Subpages:
https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna-podrocja-uredbe/privolitev/
With respect,
Mojca Prelesnik, univ. dipl. right.,
Information Commissioner
Prepared:
Mag. Andrej Tomsic,
Deputy Information Commissioner