Consenting to Data Collection

Consent is a foundational concept in contract law and permits actions that might otherwise be illegal or legally questionable.  Consent has also become a focal point in discussions about privacy and data collection.  The boundaries of what’s acceptable when it comes to data collection are ill-defined.  Generally, at least in the U.S., consent is used to mark those boundaries more clearly.  Because consent is typically in the form of notice of a wrap contract (which nobody reads), it’s usually constructive and merely a formality.  Two recent developments challenge the notion that contractual consent suffices in the context of data collection. 

The first in in the Netherlands.  (Can I just now take the opportunity now to say Thank you to the Europeans for trying to fight the data sucking coming from Silicon Valley?)  The Netherlands’ Data Protection Authority recently ruled against two companies that wanted to use “wearables” for monitoring their employees, including to monitor their sleep patterns.  The agency said that this was not allowed even with explicit permission.  That seems to me a commonsense ruling given that few employees may feel free to decline to grant such permission and so any “explicit permission” might not be entirely voluntarily.

The second development is the Federal Communications Commission’s proposed rules to require internet service providers to get express consent (opt-in) before sharing information about consumer usage with third parties.  The internet providers would still be able to share the information with affiliates for marketing purposes unless consumers opt-out.  Expect the opt-out process to be so obscure that most consumers will be unaware of the option or so burdensome that few will bother.

Unfortunately, the FCC’s proposals won't cover the major data sucking companies like Google and Facebook.  They will still be able to scan your emails and your contact lists – with your “consent” of course.