On January 18, 2024, the Office of the Data Protection Authority (ODPA) published guidance on how to correctly use the lawful processing basis of consent under the Data Protection (Bailiwick of Guernsey) Law. In particular, the ODPA highlighted the importance of consent being freely given, meaning that individuals have a genuine choice over how their data is to be used.

The guidance clarifies the specific requirements for valid consent, including that consent must be:

• prominent;
• unbundled from other terms and conditions;
• concise and easy to understand; and
• user-friendly and age-appropriate.

On the above, the guidelines also detail the basics of getting consent right including consent being specific and 'granular' and the need to get separate consent for separate purposes.

The guidance also states that requests for consent must include:

• the name of the organization;
• the name of any third parties that will rely on the consent; 
• why the data is wanted; and
• what will be done to the data.

Furthermore, individuals must be informed on how they can withdraw their consent and that they must not be put at a disadvantage when withdrawing or refusing consent. The guidance mentions additional requirements that must be followed, such as the need to keep clear records to show that consent has been given, when it was given, how it was given, and what information was communicated to individuals at the time.

Lastly, the ODPA clarified that these conditions for consent also apply in other contexts, including automated decision-making, international transfers, and data subject rights.

You can read the press release here and download the guidance here.