On 16 July 2018, the District Court of Gießen, Germany, ruled that a custodian’s representation rights also cover consent to data processing activities related to the person under custodianship. Under the EU General Data Protection Regulation (GDPR), the processing of personal data is, in principle, prohibited unless there is a legal basis for such processing. Pursuant to Art. 6 para. 1 lit. a) GDPR, one possible legal basis is the data subject’s consent. However, the legitimacy of a declaration of consent may be in doubt if the data subject lacks the capabilities to declare consent.
Requirements for a Declaration of Consent
When the processing of personal data is based on the data subject’s consent, the declaration of consent has to conform to the requirements of Art. 7 para. 1 GDPR. Pursuant to that provision (and under consideration of Recital 32), an individual’s consent must be given freely, specifically, unambiguously and in an informed manner. The fulfillment of these requirements can be insufficient if the data subject—for whatever reason—lacks the mental or physical capacity to grasp the scope or the legal consequences of his or her declaration of consent. So far, it has been somewhat unclear when and under what circumstances a person is considered incapable of giving consent, especially with regards to minors.
Capacity to Declare Consent
A declaration of consent in the sense of Art. 7 GDPR is not a contractual declaration (rechtsgeschäftliche Einwilligungserklärung). Therefore, the requirements for the capacity to contract (e.g., the legal age limit) do not apply. German courts have frequently stated that the capacity to declare consent depends not on a legal age limit but rather on individual capabilities. Even a person as young as 14 can be considered capable, depending on his or her state of mind. Only with regard to “information society services” does the GDPR specify the age of consentability to be 16 (Art. 8 para. 1 GDPR). This age limit cannot, however, be extended to other areas. If a person is incapable of declaring consent (because of minorship or physical or mental disabilities), it has so far been unclear whether and to what degree a third person, in particular a legal representative, can declare his or her consent on behalf of the person they represent.
Representation of a Data Subject’s Consent
The District Court of Gießen confirmed that the custodian, as the legal representative of the person under custodianship, can consent to the processing of personal data on behalf of the person under custodianship. Here the court relied on section 1902 of the German Civil Code whereby “the custodian represents the person under custodianship in court and from court.” Even though the declaration of consent is not a contractual declaration, the custodian is considered capable to declare consent on the representee’s behalf. It is likely that this decision can further be extended to minors under parental custody. Pursuant to section 1626 of the German Civil Code, the parental custody includes the care for the person of the child, which includes legal representation.
This article was originally published on AllAboutIP – Mayer Brown’s blog on relevant developments in the fields of intellectual property and unfair competition law. For intellectual property-themed videos, Mayer Brown has launched a dedicated channel available here.