EU DPAs stress consent requirement for Big Data initiatives

The EU Member States' Data Protection Commissioners say that individuals’ consent is almost always needed for using personal data for Big Data operations, for example, detecting trends or individuals’ behaviour and attitudes. Consent should be free, specific, informed and based on unambiguous 'opt-in', as otherwise further use cannot be considered compatible. For example, tracking and profiling for purposes of direct marketing, or location-based advertising, would require opt-in.
In its recent Opinion on purpose limitation, the EU’s Article 29 Data Protection Working Party makes recommendations for amendments to the EU DP draft Regulation. The DPAs stress:

- the relationship between the purposes for which the personal data have been collected and the purposes for further processing;
- the context in which the personal data have been collected and the reasonable expectations of the data subjects as to their further use;
- the nature of the personal data and the impact of the further processing on the data subjects;
- the need for safeguards to be adopted by the controller to ensure fair processing and to prevent any undue impact on the data subjects.

See the Opinion on purpose limitation, adopted on 2 April.

Slides and a Big Data special edition of PL&B's Report are now available, based on PL&B's Information Commissioner Roundtable on Big Data, held on 8th April in London. A report on this event and a checklist will be available soon for participants and, for a fee, to non-participants.