WP29 Guidance on Consent & Transparency

The Article 29 Working Party (WP29) is an advisory body consisting of a representative from the data protection authority of each of the EU member states, the European Data Protection Supervisor and the European Commission. WP29 provides expert advice to member states regarding data protection.

WP29 have released draft guidelines on transparency and consent, two key areas of the impending General Data Protection Regulation (GDPR).

The guidelines, which were published in mid-December, aim to provide further clarity on the core requirements of each area under the GDPR, offering more detailed definitions, plus insights on issues such as the rights of data subjects, exemptions and specific areas of concern.

Both documents are now available to download and are open for comments until 23 January 2018.

Guidelines on transparency
Transparency, under the GDPR, is now a ‘fundamental aspect’ of the EU’s fairness principles and is ‘intrinsically linked to accountability’ under the new regulation.
In addition to outlining the meaning of transparency, the guidance produced by the WP29 also provides a thorough overview of:

  • Elements of transparency under the GDPR
  • Information to be provided to the data subject
  • Exercise of data subjects’ rights
  • Exceptions to the obligation to provide information
  • Transparency and data breaches

Guidelines on Consent
As one of the legal bases to process personal data and one most crucial aspects of the regulation, it’s of paramount importance that companies comply with the new requirements.


The concept of consent has evolved under the GDPR and the new guidelines focus on the main changes and include practical tips to ensure compliance.

The key aspects of the guidelines include:

  • Elements of valid consent
  • Obtaining explicit consent
  • Additional considerations
  • Data subjects’ rights

ISBA is currently working with members of our Data Action Group to submit a response to the guidance. Advertisers can submit their own response directly.

For further details on the GDPR, please contact David Ellison.