This includes the need for appropriate consent for processing of the data, and the need for identifying all people processing the data.
And indeed transparency is a key underlying principle of GDPR, which places requirements on data controllers to clearly explain to people what personal data they intend to collect and for what exact purpose — in order to gain informed consent for processing the data (or, if not consent, another valid basis is required for the data processing to be legal).
The result was the 2012 Protection of Freedoms Act, which requires schools to obtain parental consent before processing biometric information, and which became law in October 2013.
And thereby seek to foist a greater share of the responsibility for obtaining consent to processing user data onto its customers.
The basic moral principle underlying these laws is the requirement of informed consent for processing by the data subject.
Earlier this year it began asking Europeans for consent to processing their selfies for facial recognition purposes — a highly controversial technology that regulatory intervention in the region had previously blocked.
But here's the thing: Both the current and the incoming EU legal framework for data protection sets the bar for consent to processing so-called special category data equally high — at "explicit" consent.
The regulation tightens requirements on obtaining consent for processing citizens' personal data by, for example, increasing transparency requirements — basically requiring that privacy policies be written in clear and intelligible language, explaining exactly how the data will be used, in order that people can make a genuine, informed choice to consent (or not consent).
In plainer English, this is being interpreted by data experts as the regulator stating that consent to processing personal data cannot be gained through a framework arrangement which bundles a number of uses behind a single "I agree" button that, when clicked, passes consent to partners via a contractual relationship.
TC's Constine had a scathing assessment of even the on-platform system that Facebook has devised in response to GDPR's requirements on parental consent for processing the data of users who are between the ages of 13 and 15.
Facebook's use of dark pattern design and A/B tested social engineering to obtain user consent for processing their data at the same time as obfuscating its intentions for people's data has been a long-standing criticism of the company — but one which the ICO is here signaling is very much on the regulatory radar in the EU.
