Legislation – Data (Use and Access) Act 2025

After paragraph 5 (inserted by section 67 of this Act) insert—

“6.

A data subject’s consent is to be treated as falling within the definition of “consent” in point (11) of paragraph 1 if—

(a)

it does not fall within that definition because (and only because) the consent is given to the processing of personal data for the purposes of an area of scientific research,

(b)

at the time the consent is sought, it is not possible to identify fully the purposes for which personal data is to be processed,

(c)

seeking consent in relation to the area of scientific research is consistent with generally recognised ethical standards relevant to the area of research, and

(d)

so far as the intended purposes of the processing allow, the data subject is given the opportunity to consent only to processing for part of the research.

7.

References in this Regulation to consent given for a specific purpose (however expressed) include consent described in paragraph 6.”

In section 33 (definitions), after subsection (1) insert—

“(1A)

“Consent” of the data subject to the processing of personal data means a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data (and see section 40A).”

In section 34(2) (overview of Chapter 2 of Part 3), after paragraph (a) (but before the “and” at the end of that paragraph) insert—

“(aa)

section 40A makes provision about processing carried out in reliance on the consent of the data subject,”.

After section 40 insert—

“40AConditions for consent

(1)

This section is about processing of personal data that is carried out in reliance on the consent of the data subject.

(2)

The controller must be able to demonstrate that the data subject consented to the processing.

(3)

If the data subject’s consent is given in writing as part of a document which also concerns other matters, the request for consent must be made—

(a)

in a manner which clearly distinguishes the request from the other matters,

(b)

in an intelligible and easily accessible form, and

(c)

in clear and plain language.

(4)

Any part of a document described in subsection (3) which constitutes an infringement of this Part is not binding.

(5)

The data subject may withdraw the consent at any time (but the withdrawal of consent does not affect the lawfulness of processing in reliance on the consent before its withdrawal).

(6)

Processing may only be carried out in reliance on consent if—

(a)

before the consent is given, the controller or processor informs the data subject of the right to withdraw it, and

(b)

it is as easy for the data subject to withdraw the consent as to give it.

(7)

When assessing whether consent is freely given, account must be taken of, among other things, whether the provision of a service is conditional on consent to the processing of personal data that is not necessary for the provision of that service.”