The principle of consent is a central principle in Israeli privacy law. According to this principle, in the absence of authorization, an invasion of a person’s privacy can only be done with their consent and only in circumstances where they have the ability to decide what information concerning them will be disclosed, to whom, and for what purposes. Consent also reflects a person’s ability to control information about themselves. In this disclosure, the Privacy Protection Authority presents and clarifies its position on the application of the principle in light of the evolving digital reality, as well as regarding the applicability of the Protection of Privacy Law, 1981.
The disclosure reflects the legal interpretation that the Authority will use when and for the purpose of exercising the various powers vested in it by law, including supervision of compliance with the provisions of the law and regulations thereunder, registration of a database in the registry of information databases, including cancellation or suspension of an existing registration, and the imposition of an administrative fine or financial sanction for violating the provisions of the law.
The disclosure does not deal with when and under what circumstances the obligation to request the data subject’s consent for an invasion of privacy applies, but rather presents the Authority’s interpretation regarding questions of what constitutes valid consent under privacy protection laws, and what are the rules by which such consent must be obtained.
The following are the main points of the disclosure:
Content of the request for informed consent and its presentation:
Consent to an invasion of privacy, whether express or implied (i.e., implicitly), must be informed. Therefore, the consent requester must act in a manner that ensures that the data subject is aware of the content of the request, its purposes, and the consequences of their consent or refusal to the request.
The disclosure clarifies that compliance with the “informed” consent requirement is examined not only in relation to the type and scope of the data presented to the data subject for their consent, but also in relation to how it is presented. Consent given without the person having had a reasonable opportunity to understand the meaning of their consent and its consequences will not be considered valid consent. Therefore, care must be taken to ensure that the content of the consent and the accompanying information are presented clearly, accessibly, simply, and understandably. Special attention should be given in this context to special populations, such as people with disabilities.
In circumstances where there are power imbalances between parties, or when dealing with an action with the potential for severe invasion of privacy, or in other complex circumstances (such as the use of new technology whose implications are not sufficiently clear) – this obligation should be considered an enhanced obligation, and the consent requester must ensure to present all relevant data for the decision prominently and simply, and as much as possible separately from other components of the transaction. Lack of sufficient detail in the consent process may lead to a violation of the validity of the consent.
In cases where a service requests to collect information for various purposes that are substantially different from the main purpose of the transaction, this must be clearly and prominently stated when presenting the purposes of use, as much as possible separately from other components of the transaction, before consent is given.
Free will, power imbalances, and “suspicious” consent:
In certain situations where there is an inherent concern that the consent given is “suspicious” (such as consent given in a situation where there are clear power imbalances between the consent requester and the data subject) – the burden of proving that consent to an invasion of privacy was given out of free will may fall on the consent requester. To examine whether consent was given out of free choice and will, the following will be examined, among others:
- Circumstances of consent.
- Time of consent.
- Manner of presentation of the consent request (including the information requester’s use of “dark patterns” and design tools intended to make it difficult for the data subject to understand the meaning of their consent and its consequences).
- Manner of obtaining consent (express or implied; actively or passively).
Identity of the parties and their power relations
In cases of suspicious consent, the consent requester may take various measures – such as offering a reasonable alternative or not making consent to the collection of unnecessary information a condition for receiving the service – to demonstrate that the consent reflects the data subject’s free will and true choice. The existence of another alternative available to the data subject from other entities providing a similar service can also be considered an adequate response to the claim that the data subject’s consent is not free.
Manner of obtaining consent:
The manner of obtaining consent may affect its validity. Even in cases where reliance on implied consent is possible, it is advisable whenever possible to approach the person for their express consent, especially in cases of sensitive data collection or actions that may lead to severe invasion of privacy.
As a general rule, a person’s silence, or lack of protest to the collection of information concerning them, does not in itself constitute valid consent under privacy protection laws. Giving verbal consent is a matter requiring proof, and therefore it is recommended that the consent requester document it by means that can be presented, especially in cases of sensitive data collection or in circumstances where there are power imbalances between the parties.
As a general rule, consent can be given actively (Opt-in) or passively (Opt-out), depending on the circumstances. However, the Authority clarifies that in cases where an agreement includes clauses for consent to the use of personal information for “profiling” purposes that are not required or directly related to the purpose of a service between parties with power imbalances – passive consent is not sufficient, and consent must be obtained through a separate active consent mechanism (Opt-in).
Invasion of privacy without consent – reliance on defenses:
The Authority clarifies that an entity that invades a person’s privacy without their consent and seeks to rely on the provisions of Section 18(2) of the Law for this purpose must meet the proportionality requirement (Section 20(b) of the Law). This includes being able to point to the legitimate reasons and interests that, in its view, justify its invasion of the data subject’s privacy, and if not, it may be held to have “knowingly invaded privacy to a greater extent than was reasonably necessary” for the interests protected by Section 18 and to have acted in bad faith.
Withdrawal of consent:
In cases where personal information is used based on consent lawfully obtained, and the data subject wishes to withdraw their consent and cease the use of information about them, this request should be favorably considered, even in cases where the consent is not irrevocably given from the outset, and especially in situations where continued use of the information would severely harm the requester’s privacy.
The disclosure also notes that implementing various measures to strengthen the consent process – such as preferring express over implied consent; using an active consent mechanism (as opposed to passive); and using technological and design tools to simplify and make accessible the consent requirement and its accompanying information (in cases where these measures are not legally required) – will allow the controller to demonstrate that the consent received was lawfully obtained.