The final GDPR consent guidance will be published by the Information Commissioner’s Office this week – perilously close to the May 25 D-Day – and almost a year after it originally said it would be released.
While the regulator has faced stinging criticism for its perceived ‘go-slow’, the ICO has been restricted by the cumbersome decision-making machine process emanating from Brussels.
The ICO first released its draft consent guidance in March 2017 but has been waiting for the Article 29 Working Party – the body made up of the data protection heads of EU member states – to finally approve its own guidance, which was only put out to consultation in December last year.
A29WP has now finally agreed the wording and, although it has been passed with only minor amendments, it will take the UK regulator another few days before completing the update of its own draft. The exact day of publication is unknown but ‘imminent’.
Information Commissioner Elizabeth Denham has consistently pushed back against claims that UK firms are being held back by the delay, insisting companies should stick to its original draft as this is unlikely to change.
This has met with short shrift from many industry professionals, not least over regulations surrounding third party data. Indeed at the time the original draft was released, the UK Direct Marketing Association (DMA) was heavily critical, especially around third party data legislation. It recently reiterated these concerns, requesting answers from the ICO about how the third-party industry would be affected.
In the meantime, the DMA has recently released its latest GDPR guidance (26th April) which aims to clear up the confusion about whether companies can use legitimate interests or consent to process marketing data.
The “GDPR Guidance for Marketers: Consent and Legitimate Interests” has been produced with the collaboration of ISBA, the Data Protection Network and the ICO, and has used case studies already published by the DPN and the ICO in an effort to establish a consistent position on GDPR.
ICO: Consent Guidance
Decision Marketing: DMA demands answers over threat to third-party data
Data Protection Network: When will we get final guidance on consent?