On 16 July 2018, the District Court of Gießen, Germany, ruled that a custodian's representation rights also cover consent to data processing activities related to the person under custodianship. Under the EU General Data Protection Regulation (GDPR), the processing of personal data is, in principle, prohibited unless there is a legal basis for such processing. Pursuant to Art. 6 para. 1 lit. a) GDPR, one possible legal basis is the data subject's consent. However, the legitimacy of a declaration of consent may be in doubt if the data subject lacks the capabilities to declare consent.
Requirements for a Declaration of Consent
When the processing of personal data is based on the data subject's consent, the declaration of consent has to conform to the requirements of Art. 7 para. 1 GDPR. Pursuant to that provision (and under consideration of Recital 32), an individual's consent must be given freely, specifically, unambiguously and in an informed manner. The fulfillment of these requirements can be insufficient if the data subject—for whatever reason—lacks the mental or physical capacity to grasp the scope or the legal consequences of his or her declaration of consent. So far, it has been somewhat unclear when and under what circumstances a person is considered incapable of giving consent, especially with regards to minors.
Capacity to Declare Consent
A declaration of consent in the sense of Art. 7 GDPR is not a contractual declaration (rechtsgeschäftliche Einwilligungserklärung). Therefore, the requirements for the capacity to contract (e.g., the legal age limit) do not apply. German courts have frequently stated that the capacity to declare consent depends not on a legal age limit but rather on individual capabilities. Even a person as young as 14 can be considered capable, depending on his or her state of mind. Only with regard to "information society services" does the GDPR specify the age of consentability to be 16 (Art. 8 para. 1 GDPR). This age limit cannot, however, be extended to other areas. If a person is incapable of declaring consent (because of minorship or physical or mental disabilities), it has so far been unclear whether and to what degree a third person, in particular a legal representative, can declare his or her consent on behalf of the person they represent.
Representation of a Data Subject's Consent
The District Court of Gießen confirmed that the custodian, as the legal representative of the person under custodianship, can consent to the processing of personal data on behalf of the person under custodianship. Here the court relied on section 1902 of the German Civil Code whereby "the custodian represents the person under custodianship in court and from court." Even though the declaration of consent is not a contractual declaration, the custodian is considered capable to declare consent on the representee's behalf. It is likely that this decision can further be extended to minors under parental custody. Pursuant to section 1626 of the German Civil Code, the parental custody includes the care for the person of the child, which includes legal representation.
This article was originally published on AllAboutIP – Mayer Brown's blog on relevant developments in the fields of intellectual property and unfair competition law. For intellectual property-themed videos, Mayer Brown has launched a dedicated channel available here.
Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.
© Copyright 2018. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.