Conceptually, pursuant to Article 5, item XII, of the General Personal Data Protection Law (LGPD), “consent” is defined as “a free, informed, and unambiguous expression by which the data subject agrees to the processing of their personal data for a specific purpose.” Article 8 of the LGPD provides further detail regarding the characteristics of consent for the processing of personal data. In its caput, the article refers to Article 7, item I, which lists the aforementioned “legal basis.” It is important to note that there are differences in wording between Article 7, item I, and Article 11, item I, of the LGPD. Both specify consent as a basis for processing, with the former relating to the processing of personal data and the latter to the processing of sensitive personal data.
In Article 11, the processing of sensitive personal data based on consent requires that the data subject or their legal guardian consent “in a specific and prominent manner, for specific purposes”; on the other hand, Article 7, I, does not contain the same requirements, limiting itself to indicating the possibility that the processing of personal data may occur “upon the data subject’s provision of consent.”
In general terms, regarding the form of consent, the law is clear: “it must be provided in writing or by another means that demonstrates the data subject’s expression of will” (Art. 8, caput). The admission of means other than the traditional written form—indicating that it is not a requirement—while its lawfulness cannot be denied, reveals a dimension concerning the high degree of freedom expected in relationships derived from informational self-determination, which guides the structure of the law.
Article 60 of the LGPD expressly amended two provisions of the Brazilian Civil Rights Framework for the Internet, but the wording of Article 7, VII—which already required express consent—remains in force, although, as noted earlier, Article 7, I, of the LGPD establishes the requirement that consent be unequivocal, proven by any lawful means, which allows for the validity of verbal or implied consent.
The act of consent, in order to be considered “informed,” typically takes on characteristics found in the doctrinal framework of objective good faith. As Isabella Frajhof and Ana Lara Mangeth point out, “recognizing that the information provided to the data subject constitutes a legitimizing element of their consent regarding the processing of their personal data, (...) the data subject must be informed of certain specific aspects of the processing so that there is a complete understanding of the purpose for which their personal data will be used” (1). To ensure that these details are understood, a document is expected to be drafted, with visual emphasis placed on the terms that indicate consent to the processing of personal data.
By way of example, consider the healthcare sector, where there is typically a strong emphasis on ensuring patients are fully informed about all aspects relevant to their care. The preparation of Informed Consent Forms —TCLEs—is a common and desirable practice, long encouraged, from which important lessons can be drawn regarding how obtaining written consent tends to foster greater trust between the healthcare professional and the patient (2). In fact, even in documents drafted with a high degree of technical detail—which may be difficult for laypeople to understand—explanations, clarifications, and the corresponding consent can be effectively obtained by highlighting the relevant clauses, without causing cognitive confusion or hindering the assessment of the patient’s expression of consent (3).
In this regard, it is worth noting the distinction between consent for medical care and consent regarding the processing of personal data. On this topic, Flaviana Rampazzo Soares explains that “it can be stated that [the patient’s consent for healthcare services] is subject to the LGPD with regard to the data and information related to it, and not with regard to the subject matter and purpose of the consent itself (which is a specific medical service), and the LGPD’s scope will be limited to matters concerning data processing” (4). This dynamic becomes even more complex—it must be emphasized—when it involves sharing data with other data controllers, in which case the provisions of Article 7, §5, and Article 11, §4, of the LGPD will apply, requiring specific consent, in the first provision, on a prior basis (5).
In this regard, the “opt-in” consent model appears to prevail as the method for obtaining consent (6). In short, rather than the data subject choosing not to allow the processing of their personal data, they take an action that can be interpreted as an expression of positive consent. This can be done through various methods: (i) checking a box; (ii) clicking a button or link; (iii) selecting from a binary option (yes/no), buttons, or a drop-down menu; (iv) by choosing settings or preferences in the account dashboard; (v) by replying to an email requesting consent; (vi) by responding affirmatively to a clear request for recorded verbal consent, either in the presence of the other party or over the phone; (vii) by signing a consent form on paper; (viii) by electronically signing a document using a lawful and sufficiently reliable cryptographic technique.
This is clearly an illustrative list, which still leaves room for more intriguing and timely discussions regarding the close relationship between design, interactivity, cognizability, and the law. Undoubtedly, rather than merely simplifying cognition, certain techniques and tools can optimize the dialogue between the data subject and the processing agent for the purpose of obtaining consent—and, especially, regarding the expected emphasis that must be placed on the written format, as required by paragraph 1 of Article 8 of the LGPD for personal data and subparagraph I of Article 11 for sensitive personal data.
According to Chiara Spadaccini de Teffé, the term “prominent” “can be interpreted to mean that it is important for the data subject to have full access to the document that will provide all relevant facts regarding the processing of their personal data, and such provisions must be highlighted so that consent is given in accordance with the law” (7).
This opens the door to user-centered interaction strategies that prioritize understanding the content that will create the binding relationship. More than formal robustness, it is important to view highlighting as a mechanism for increasing the level of interaction between the parties involved so that there is an adequate and accurate understanding. In this regard, fostering interactivity undeniably highlights the redesign of documents (especially contracts, in the trend that specialized legal doctrine has come to refer to as “contract design” (8)) so that they are not only aesthetically superior, but also to ensure they lead to a rapid and more effective assimilation of content (9).
A topic that will take on significant prominence in redefining the ways consent is obtained involves the field now commonly referred to as user experience (UX), whose focus—centered on experiences and perceptions (10), —is highly relevant to ensuring that creative methods for obtaining feedback, which are lawful and supported by the provisions of Article 8 of the LGPD, are designed and implemented in various activities involving the processing of personal data.
Camilla Telles’ summary is insightful: “Experiences are clearly subjective, since each user has a different experience when using a product, service, or object. This is because the experience is influenced by various human factors (vision, reading ability, skill, etc.) and external factors (temperature, environment, time of day). All of a person’s interactions with a brand, product, or service—whether at the time of purchase or use, including the emotional aspect—are defined as the user experience” (11).
This perspective is of immense value for reviewing the infamous “terms of use” and “privacy policies,” which are generally standardized, lengthy, and repetitive (12). The more concise, clear, and informative such documents are, the more they tend to convey clarity, thereby strengthening transparency in the processing agent’s operations and complying with the various principles listed in Article 6 of the LGPD.
The same can be said of the implementation of visual elements (referred to in legal circles as “visual law”), which facilitate the reading and comprehension of important information. When it comes to giving consent—which is traditionally obtained through a quick presentation of terms and conditions that users do not usually read with due attention—simplification can yield significant benefits. Visual elements have the distinct advantage of replacing lengthy texts—for example, with illustrations and diagrams—thereby facilitating understanding and engaging intuition to prevent hasty consent.
This concern is justified, as there is significant information asymmetry—especially in structures that rely on the internet for the expression of consent—which implies considering the different perceptions each person may have when encountering legal documents that spell out the conditions for the processing of personal data.
In fact, “even though legal documents—particularly those related to privacy and personal data protection, which are of significant importance—are available on data controllers’ platforms and formally comply with the principles of transparency and accountability, questions arise regarding the effective and substantive compliance with those principles” (13).
From a renewed perspective—one that moves away from the standardized models of the past, such as the now-outdated shrink-wrap and click-wrap adhesion contracts and browse-wrap terms of use (14)— in favor of leaner structures—which do not, however, hinder understanding—what becomes apparent is the need for processing agents to focus on restructuring the mechanisms they use to inform and clarify matters for data subjects regarding the processing activities they carry out. And, with increased understanding, there will be greater trust at the moment consent is given.
(1) FRAJHOF, Isabella Z.; MANGETH, Ana Lara. As bases legais para o tratamento de dados pessoais. In: MULHOLLAND, Caitlin (org.). A LGPD e o novo marco normativo no Brasil. Porto Alegre: Arquipélago Editorial, 2020, p. 70.
(2) CARVALHO, Carla; TATAGIBA, Laís. A utilidade das ferramentas de legal design para o consentimento efetivamente esclarecido. In: FALEIROS JÚNIOR, José Luiz de Moura; CALAZA, Tales (coord.). Legal design: teoria e prática. 2. ed. Indaiatuba: Foco, 2023, p. 441-458.
(3) As we have previously noted: “The legislature views consent as a safeguard against the improper collection of data. The law permits data processing based on the consented collection of personal data, including sensitive personal data (subparagraph X of Article 5 and subparagraph I of Article 11), but requires adherence to a specific purpose. This stems from the need for a new perspective on information. To the extent that consent becomes the fundamental criterion for collection, it is essential that individuals be able to discern the limits and risks they will face when providing their data to a particular entity.” FALEIROS JÚNIOR, José Luiz de Moura. Reflexões sobre as bases legais para o tratamento de dados pessoais relativos à saúde na Lei Geral de Proteção de Dados Pessoais. Revista de Direito Médico e da Saúde, Brasília, n. 24, p. 11-26, set. 2021, p. 18.
(4) SOARES, Flaviana Rampazzo. Consentimento no direito da saúde nos contextos de atendimento médico e de LGPD: diferenças, semelhanças e consequências no âmbito dos defeitos e da responsabilidade. Revista IBERC, Belo Horizonte, v. 4, n. 2, p. 18-46, maio/ago. 2021, p. 34.
(5) This situation bears similarities to the rules established in the GDPR, requiring the adoption of precautions, as explained by Carla Barbosa: “Naturally, this sharing of data must be carried out with due caution, since it is necessary to assess whether and to what extent such sharing is strictly necessary (...). In any case, such processing of health data authorized for reasons of public interest should not result in the data being processed for other purposes by third parties, such as employers, insurance companies, or banks.” BARBOSA, Carla; LOPES, Dulce. RGPD: compartilhamento e tratamento de dados sensíveis na União Europeia – o caso particular da saúde. In: DALLARI, Analluza Bolivar; MONACO, Gustavo Ferraz de Campos (coord.). LGPD na saúde. São Paulo: Thomson Reuters Brasil, 2021, p. 50.
(6) HEIMES, Rita. How opt-in consent really works. IAPP, 22 fev. 2019. Disponível em: https://iapp.org/news/a/yes-how-opt-in-consent-really-works/. Acesso em: 27 dez. 2022.
(7) TEFFÉ, Chiara Spadaccini de. Dados pessoais sensíveis: qualificação, tratamento e boas práticas. Indaiatuba: Foco, 2022, p. 149.
(8) See, among others, HAAPIO, Helena. Next generation contracts: a paradigma shift. Helsinque: Lexpert, 2013, p. 49-52. PASSERA, Stefania. Beyond the wall of text: how information design can make contracts user-friendly. In: MARCUS, Aaron (ed.). Design, user experience, and usability: users and interactions. 4th International Conference, DUXU 2015 Proceedings, Part II. Cham: Springer International, 2015, p. 341-352; COMPAGNUCCI, Marcelo Corrales; HAAPIO, Helena; FENWICK, Mark. The many layers and dimensions of contract design. In: COMPAGNUCCI, Marcelo Corrales; HAAPIO, Helena; FENWICK, Mark (ed.). Research Handbook on Contract Design. Cheltenham: Edward Elgar, 2022, p. 2-18.
(9) MIK, Eliza. Engineering consent: using technology to create informed consumers. In: COMPAGNUCCI, Marcelo Corrales; HAAPIO, Helena; FENWICK, Mark (ed.). Research Handbook on Contract Design. Cheltenham: Edward Elgar, 2022, p. 403-404.
(10) This issue involves a genuine cultural shift, which, for processing agents in any sector, may entail a profound reinterpretation of the more traditional models for carrying out the informative and explanatory activities involved in obtaining free and unambiguous consent, so that interactions take true precedence, with an emphasis on the dialogue between the data subject and the agent. In the provision of legal services, this topic already allows us to speak of a “legal customer experience,” as legal doctrine explains: “In summary, to build the legal customer experience, define your objective and—most importantly—put the client at the center of decisions. Next, nurture relationships—value the experiences of the people who join forces to help you achieve your goal, whether they are employees, partners, or suppliers. And last but not least, manage processes—the culture must be vibrant; it must be present in all areas and departments of your organization.” COELHO, Alexandre Zavaglia; BATISTA, Cynara de Souza. Deisgn de serviços jurídicos. In: FALEIROS JÚNIOR, José Luiz de Moura; CALAZA, Tales (coord.). Legal design: teoria e prática. 2. ed. Indaiatuba: Foco, 2023, p. 53.
(11) TELLES, Camilla. Experiência do usuário (user experience) e legal design. In: FALEIROS JÚNIOR, José Luiz de Moura; CALAZA, Tales (coord.). Legal design: teoria e prática. 2. ed. Indaiatuba: Foco, 2023, p. 231.
(12) Highlighting the importance of cooperation between design professionals and policymakers, Margaret Hagan identifies the great merit of the transformation brought about by the implementation of visual law tools: “The design professional often is focused on improving the user experience, to ensure that their target person is being satisfied, and helped to live more in the way that they want to. The policymaker professional, in contrast, tends to favor deep analysis of rules, laws, past policies, and government systems. A guiding principle tends to be that, through rigorous, critical analysis and a systems point of view, a team can identify new solutions that will produce desired outcomes, often in the form of improved population-level statistics (rather than individuals’ experiences)”. HAGAN, Margaret. Prototyping for policy. In: CAMPAGNUCCI, Marcelo Corrales; HAAPIO, Helena; HAGAN, Margaret; DOHERTY, Michael (ed.). Legal design: integrating business, design and legal thinking with technology. Cheltenham: Edward Elgar, 2021, p. 10.
(13) VILLANI, Mônica; GUGLIARA, Rodrigo; COPPOLA JÚNIOR, Ruy. Aplicação do legal design como ferramenta essencial do compliance de proteção de dados. In: FALEIROS JÚNIOR, José Luiz de Moura; CALAZA, Tales (coord.). Legal design: teoria e prática. 2. ed. Indaiatuba: Foco, 2023, p. 215.
(14) On this topic, see LIMA, Cíntia Rosa Pereira de. Contratos de adesão eletrônicos (shrink-wrap e click-wrap) e os termos e condições de uso (browse-wrap). In: LIMA, Cíntia Rosa Pereira de; NUNES, Lydia Neves Bastos Telles (coord.). Estudos avançados de direito digital. Rio de Janeiro: Elsevier, 2014. p. 105-134.
Article originally written on December 27, 2022