What makes consent meaningful
OPC guidance sets out key elements:
- You know what personal information is collected.
- You know with whom it is shared.
- You know the purposes of the collection, use, and disclosure.
- You know the risks of harm and other consequences.
Express vs. implied consent
Express consent is required for sensitive information (health, financial, biometric), secondary uses you would not reasonably expect, and certain high-risk activities.
Implied consent may be enough for routine activities that you would reasonably expect when you engage with an organization.
Withdrawing consent
You can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Some information (e.g., transaction records for tax purposes) must still be retained by law.