There are three different types of consent an organization may obtain:
- Explicit Consent
- Implicit Consent
- Opt-out Consent
When an organization collects personal information from an individual, most privacy legislation requires that an individual’s consent be given so that an organization can collect, use, or disclose it. However, there are sometimes exceptions to this rule.
Explicit Consent
Explicit consent — also known as express or direct consent — means that an individual is clearly presented with an option to agree or disagree with the collection, use, or disclosure of personal information.
Explicit consent is usually required when clear, documentable consent is required, and the purposes for which it is being provided for is sensitive. Explicit consent can be provided verbally or in writing.
For example, while paying at a grocery store’s checkout lane the clerk at the counter may ask you if you would like to provide your postal code so that the grocery store can have a better understanding of where its customers live. Providing your postal code would be a very clear, direct way of giving the clerk your express consent. You would certainly not appreciate a grocery store obtaining this information and using it for these purposes without asking you.
Another example of explicit consent is signing any consent form that clearly outlines why an organization would like to collect, use, or disclose your personal information.
Implicit Consent
Implicit consent — also known as deemed or indirect consent — can mean two things:
- You voluntarily personal information for an organization to collect, use, or disclose for purposes that would be considered obvious at the time, or
- You provide personal information to an organization and it is used in a way that clearly benefits you and the organization’s expectations are reasonable.
Implied consent is usually inferred from your actions and the current circumstance you are in.
For example, if you attach a page of references with your resume and hand it to potential employers, it is implied that you give consent for employers to contact your references. A reasonable person would understand that the very nature of providing references implies that consent is given to contact them.
If you provide a donation to a charity, you may be asked to provide personal information in order to receive a tax receipt. It would be perfectly reasonable, and in your favour, for the organization to use your personal information to provide you with a tax receipt.
Opt-out consent
Opt-out consent — also known as giving consent by not declining to give consent — means that an individual is given the option to decline consent. If the individual does not clearly decline consent, consent is granted. Opt-out consent is usually done in writing.
Many organizations, especially websites, use opt-out consent as a way to request permission to use your personal information for other purposes.
For example, when purchasing a product online, you may be presented with a checkbox and asked to uncheck the box (opt-out) if you would not like your personal information shared with affiliates for marketing purposes.
Businesses like opt-out consent because it requires action. Many individuals fail to read everything and therefore are far more likely to provide consent for purposes that would benefit an organization.
Exceptions to Obtaining Consent
Depending on the privacy legislation an organization is subject to, your personal information may be collected, used, or disclosed without your knowledge or consent.
This is usually done when it is impossible or impractical to seek your consent, such as for legal, medical, or security reasons, or for lawful purposes such as for the prevention of fraud or enforcement of the law.
