Explicit Consent (GDPR)
Definition
A higher consent standard required for special-category data processing under Article 9(2)(a): must be freely given, specific, informed, and involve an explicit affirmative act. Blanket consent in employment contracts is insufficient.
- Legal basis
- GDPR Article 9(2)(a)
- Data category
- Special-category data, includes biometric data
- Standard
- Freely given, specific, informed, explicit affirmative act
- Insufficient example
- Blanket consent buried in an employment contract
Common questions
Why is ordinary GDPR consent not enough for biometric data?+
Biometric data used for identification falls into the special category under Article 9, which carries a higher bar because of the sensitivity and permanence of the data, so processing it requires the stricter explicit standard rather than the general consent basis.
Can an employer rely on employee consent for biometric access control?+
It is legally fragile. Regulators generally view consent from an employee as not freely given because of the power imbalance in employment, so employers typically need a different legal basis, such as substantial public interest, rather than consent alone.
Related terms
- Aadhaar Exclusion (DPDP Act S.17(2))
- Provision that exempts processing covered by the Aadhaar Act 2016 from the general DPDP Act regime, meaning UIDAI biometric data is governed...
- Adequate Country (GDPR Ch. V)
- A country that the European Commission has determined provides a level of data protection essentially equivalent to the EU's. As of mid-2026,...
- Biometric Identifier (BIPA)
- Under Illinois BIPA: a retina or iris scan, fingerprint, voiceprint, or scan of a person's hand or face geometry; distinct from 'biometric...
- Data Fiduciary (DPDP Act)
- Any person who alone or in conjunction with others determines the purpose and means of processing personal data; the DPDP Act equivalent...
- Data Protection Impact Assessment (DPIA)
- A structured risk assessment required under Article 35 before any processing that is likely to result in high risk to individuals' rights...
- Per-Violation Damages (BIPA)
- BIPA's statutory damages structure: USD 1,000 per negligent violation or USD 5,000 per intentional/reckless violation; confirmed by Cothron v. White Castle (2023)...
- Real-Time Remote Biometric Identification (RTBI)
- As defined in the EU AI Act: automated identification of natural persons at a distance by comparing their biometric data to those...
- Special-Category Data (GDPR)
- Personal data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, biometric data for unique identification, health data,...
- Standard Contractual Clauses (SCCs)
- Pre-approved contract terms issued by the European Commission that create GDPR-compliant safeguards for cross-border data transfers to countries without an adequacy decision....