Term of consent in data protection law
In accordance with Article 6(1)(a) of the GDPR, one possible legal basis for data processing is the consent of the data subject. Under this provision, consent is a feasible and valid legal basis for data processing if consent was demonstrably issued by the data subject in an informed manner for specific explained purposes, and provided that the data subject's consent can be revoked at any time without citing grounds.
But once consent is issued, how long does it remain in effect in cases where no time limit is specified? In its recent 24th Activity Report, the Commissioner for Data Protection and Freedom of Information of the State of North Rhine-Westphalia makes the blanket statement that consent for data processing generally remains in effect for a period of two years only. No grounds are cited for this view.
The GDPR itself defines no time limit for the validity of consent. However, the question as to whether consent, once issued, is valid "forever" is a subject of controversy in the legal literature as well, and there are arguments on both sides of the question.
Arguing against an automatic expiration date, aside from the fact that no such expiration date is provided by law, is the fact that data subjects can exercise their right to revoke consent at any time, without citing grounds. In other words, data subjects can easily put an end to data processing which is conducted based on their consent. Accordingly, requiring controllers to ask for consent every 2 years may not even be in the interest of data subjects, and would be regarded as a mere formality.
A possible argument in favor of automatic expiration is that the conditions for data processing based on consent may change, so that it may be in the interest of the data subject to make a new decision. The Data Protection Commissioner of the State of Saxony-Anhalt, in its 13th/14th Activity Report, stated that the term of consent in e-mail advertising should be limited to 17 months, referring to a judgment by the District Court of Munich (Case No. 17 HK O 138/10). It should be kept in mind, however, that this case involves consent in terms of competition law (in accordance with § 7(2) No. 3 of the Act on Unfair Competition) and that the judgment was issued before the GDPR took effect.
In a more recent judgment, the Federal Supreme Court (Case No. III ZR 196/17) rules that the validity of consent based on § 7 of the Act on Unfair Competition is not subject to a time limit, since no such time limit is provided for by law. But "consent" in terms of § 7 of the Act on Unfair Competition, which is the subject of the matter in question, is not defined in the Act itself; instead, the court relied on the definition in Directive 95/46/EC, the Data Protection Directive, which was still in effect at the time the judgment was issued. Since the Data Protection Directive has now been replaced by the GDPR, the requirements in Article 4 No. 11 and Article 7 of the GDPR apply effective immediately. It is to be assumed that the statements in the Federal Supreme Court's Judgment are still applicable in the current legal situation, due to the fact that the provisions relating to consent are largely unchanged. At the very least, the GDPR says nothing about consent expiring. But it should be mentioned that, in the above case, consent was in any case limited to the duration of a contractual relationship, and the duration of the relationship was two years.
In its Opinion on the definition of consent (WP 187), the former Article 29 working party (now the European Data Protection Board, EDPB) recommends that data processing conducted based on consent should be subjected to review "after a certain time" and that data subjects should be informed about their current choice and offered the opportunity to either confirm or revoke their consent. However, it is not assumed that consent, once issued, is subject to an automatic expiration date.
In conclusion, there are strong arguments in favor of the view that consent is not subject to an automatic expiration date, although the legal debate on this question is not yet over. In particular, some supervisory authorities are taking a stricter view.