Does anyone know of any decent articles/guidance exploring the issue of ‘capacity’ and consent as a lawful basis?
I’m aware of Article 8’s very specific focus on consent of children in the context of information society services – but I’m looking more for any work that has been done around asking for consent to process personal data of adults with impaired capacity. Would be very interesting to see something in the especially niche area of providing addiction and mental health support.
Liz
Hi, I’m not sure if this is any help at all but I’ve just come across an article on the ico website on consent and capacity:
The UK GDPR does not contain specific provisions on capacity to consent, but issues of capacity are bound up in the concept of ‘informed’ consent. Generally, you can assume that adults have the capacity to consent unless you have reason to believe the contrary. However, you should ensure that the information you provide enables your intended audience to be fully informed. It may be that you do have reason to believe that someone lacks the capacity to understand the consequences of consenting and so cannot give informed consent. If so, a third party with the legal right to make decisions on their behalf (eg under a Power of Attorney) can give consent.
Heres the link: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/what-is-valid-consent/#what8