Trello, the project management app, updated its terms of service recently. This is the notification it used to convey the change to its users:
By clicking “I Agree” or otherwise continuing to use Trello, you agree to these new terms. If you don’t want to agree to the new terms, you may delete your Trello account. [emphasis supplied]
The highlighted portion assumes consent by default. This is an admittedly loose usage of the term consent because it is questionable if what is being assumed here can even be called consent. For example, would such language be valid if the draft Personal Data Protection Bill, 2018 were to be in effect in its current form? The Bill says that for processing of personal data based on consent to be valid, the consent must have five features. It must be free, informed, specific, clear, and capable of being withdrawn. Are these features present in the language used? The answer is no.
Would this be covered under any of the other grounds for processing data that do not require consent under Chapter III of the Bill? The answer is no again. Besides, a company’s claim of relying on a different ground for processing will be undermined by the fact that they are also providing users with the option of providing their consent. A larger question that needs to be asked here is how often should an individual be required to provide her consent after she is already subscribed to a product or service.
For now, the clumsy framing of the highlighted language might land a company using it in a tricky situation when the law comes into effect. This only goes to show that the data protection landscape is still hazy and much care and foresight will be required when drafting the legalese to govern it.