Telegram 
Viber 
Whatsapp 
Messenger Withdrawal of consent to the processing of personal data
In its letter dated 26.04.2013, the Ministry of Justice expressed the opinion that the issue of withdrawing consent to the processing of personal data has already been regulated by the legislator.
Here are the key points enshrined in the law:
- By its legal nature, consent to the processing of data is a transaction, and by analogy the withdrawal should be made in the same form as the consent;
- The withdrawal of consent can only concern the future processing of data, not data that have already been processed; that is, it does not have retroactive effect;
- The owner, after accepting a withdrawal statement, no longer has reasons to retain the data.
Analyzing the position of the Ministry of Justice, one can identify controversial points, namely:
- Both the content of the withdrawal statement and the grounds for such an action remain unclear.
- If this is a transaction, does the owner have the right to refuse to accept the withdrawal statement, treating it as a unilateral termination of the contract?
- If the consent given to an enterprise that issued, for example, discount cards is withdrawn, what should the owner do with the personal data of the recipients of such cards?
It is possible to agree with the Ministry of Justice’s opinion that withdrawal of consent is a kind of termination of the transaction. However, the granting of consent itself is not the only basis for processing data, since in the Law «On Personal Data» the possibility of submitting such a statement is linked not only to the will of the individual. Therefore, for the withdrawal of consent, in addition to the individual’s desire, there must be violations of the law that have resulted in infringements of the individual’s rights as a subject of personal data.
As for the situation that arose in the example described above, the enterprise that accepted the cardholder’s withdrawal statement no longer has the right to retain the buyer’s personal data, and as a result the card must be returned to the owner.
Based on the foregoing, one cannot agree with the Ministry of Justice’s view that the issue of withdrawal of consent to data processing is fully regulated.