Translations:Synthèse du règlement sur la protection des données/4/en

Article 6 states that a user's ('data subjects') consent is required for data processing. This consent can, for instance, be obtained during the initial registration with a social network service when the user agrees to the EULA and thus to the use of their data by the company. It states that “'the data subject's consent' means any freely given specific, informed and explicit indication of his or her wishes” (Article 4(8)). Moreover, it is specified that it “shall be as easy to withdraw consent as to give it.” (Article 7(3)).

The regulation, as proposed, contains a huge loophole in the form of the notion of “legitimate interest” (see Article 6(1)(f)). Left too vague and undefined in the regulation, it would allow companies to argue “legitimate interest” in order to by-pass the constraints inherent in the requirement for users' consent. It would allow the use of personal data in ways that the user did not consciously agree to.