Verbal Consent and the GDPR

We are often asked about consent and the GDPR. But, what consent can be given face to face or over the telephone?

Verbal consent and the GDPR, is verbal consent allowed? Given the documentation requirements of the law, one might expect the answer to be no. However, the answer to this question is actually yes. This is provided that certain conditions are met.

This is the obvious approach as so much of business and customer service is conducted over the telephone. It would require a radical change in current practices otherwise. If your business could not obtain consent to handle and process client data on the telephone by a member of your team, this would prove to be painful.

The GDPR does not explicitly prohibit verbal consent. Recital 32 confirms this by stating that an oral statement may be sufficient as a clear affirmative act sufficient for consent.

Additionally, the Information Commissioner’s Office indicated that answering yes to a clear verbal consent request was sufficient to meet the need for opt-in. If verbal consent is needed for various different purposes, the best practice is to ask for a separate opt-in for each.

Silence or blanket acceptance of the terms and conditions should not be applied to obtain consent.

Evidence of Consent

If evidence of consent is to be used, it should include a recording, if available. The recording of the conversation must comply with regulations including MiFID II. This should include the name of the individual providing consent. You must record the date and time, together with any other information necessary to obtain valid consent. For example, in the case of a child, their parent, or guardian’s consent. The consent should be logged in the CRM system or worst case, on a spreadsheet.

For additional information, check out our guide on obtaining consent here.

Verbal consent and the GDPR need not be paper-based, though this isn’t a bad idea if the opportunity arises to gain a signed consent form. Once you have the form, make sure you store it securely or scan it and add it to the client record. Then, shred the original and record that you have done so.

On the road again

We all hope that the COVID-19 pandemic will soon be under control. When it’s safe, exhibitions are likely to return, and we will start meeting face to face again. At a show, whether you are exhibiting or not, it’s worth asking for consent. It is worth considering marking a business card received with a ‘C’ to indicate that consent was received. The same should be applied to business networking. However, membership of such organisations generally implies consent, be it BNI or a local Chamber of Commerce.

However you manage your contacts, make sure you know what your legal bases for processing are. If verbal consent is the legal basis then record in your CRM or Data Asset Register exactly how you have received this. With verbal consent and the GDPR, the devil is in the detail.

If you would like to know more about verbal consent and the GDPR then please call us on 03333 22 1011 and we would be happy to help. You can contact us here or book an initial free, no-obligation consultation here.