Browser settings could signify consent to personal data processing under new data protection rules

Justice ministers from the 28 EU countries could give provisional support to the plans at a meeting scheduled for later this week, where further progress is set to be announced on the negotiation of the planned new EU General Data Protection Regulation. The proposals are contained in new leaked correspondence (30-page / 117KB PDF) from the Latvian presidency of the Council of Ministers to the Council's Permanent Representatives Committee (COREPER).

"Where it is technically feasible and effective, the data subject's consent to processing may be given by using the appropriate settings of a browser or other application," the draft provisions under consideration state.

The possibility to rely on browser settings to convey consumers' consent to personal data would be tied to plans to allow organisations to proceed with personal data processing activities on the basis of individuals' 'unambiguous', rather than 'explicit', consent.

The justice ministers look set to support new rules that would give businesses the freedom to process personal data if individuals have given their "unambiguous consent to the processing of their personal data for one or more specific purposes", according to the leaked document. Explicit consent would generally be required where the processing involves more sensitive personal information, it said.

The issue of consent has been a contentious issue during the negotiation of the new EU data protection laws.

In its original draft, the European Commission said that businesses seeking to rely on individuals' consent to go ahead with personal data processing should be required to obtain individuals' explicit, freely given, specific and informed consent obtained through a statement or "clear affirmative action".

The European Parliament in outlining its position on the General Data Protection Regulation backed the 'explicit' consent requirement.

However, a number of EU countries, including the UK, have raised concerns with those plans.

According to the Council of Ministers, which brings together representatives of EU governments to discuss EU legal reforms, the justice ministers are "expected to adopt a partial general approach on the general data protection regulation" at their meeting later this week, including on the proposed consent rules.

Provisional agreement is also expected to be announced on parts of the proposed Regulation on the so-called 'one stop shop mechanism'. This mechanism will set out the way data protection authorities across the EU will enforce the new rules.

Agreement on the reforms is likely to be announced on a "nothing is agreed until everything is agreed" basis. The justice ministers have previously reached similar agreements on other aspects of the draft Regulation.

Only when the justice ministers have finalised their collective position on the new data protection framework will final negotiations between the Council of Ministers and the European Parliament be opened. The two bodies would have to agree on a single wording of the Regulation before the reforms could be implemented.