On 14th September, the German data protection authorities (“DPAs”), gathering in the so called “circle of Düsseldorf”, issued a non-binding opinion (pdf, German) on the question of the lawfulness of consents under the looming General Data Protection Regulation (“GDPR”), which were obtained under the conditions of the current legal framework.

Referring to recital 171 of the GDPR, the DPAs state that currently given consents remain valid “if the manner in which the consent has been given is in line with the conditions of” the GDPR. According to the DPAs, validly given consents under the current legal framework in general fulfill these requirements.

The two important words here are: “in general”. Because this means that there exist exceptions. The DPAs further state that information obligations in accordance with Art. 13 GDPR must not be fulfilled in this regard, since these obligations don’t belong to the “conditions” referred to in recital 171.

At the end of their statement, the DPAs highlight two conditions which deserve particular attention. Already at this point, one might ask why only these two conditions deserve special attention. According to the DPAs, these conditions are Art. 7 para 4 and Art. 8 para 1. If these two conditions are not met, existing consents will not continue to apply. Confusingly, these conditions referred to by the DPAs form only a certain part of conditions which have to be met according to Art. 7 and 8 of the GDPR.

If one takes the statement of the DPAs seriously, companies would not have to meet all conditions for existing valid consents enumerated in Art. 7 and 8 of the GDPR. Does this opinion by the DPAs mean that only the conditions of Art. 7 para 4 and Art. 8 para 1 GDPR have to be met by exiting consents? Why would the opinion mention only these two conditions, if this would not be the case? In addition, it remains to be seen how other European authorities interpret recital 171.