3.3Individual rights & consent
The essentials in 30 seconds
- The person is at the centre: information, access, rectification, erasure, objection, restriction, portability — to be exercised easily.
- Valid consent = free, specific, informed, unambiguous (a positive act, unticked box) and revocable just as easily.
- Prospecting and cookies: often consent + unsubscribe; a banner offering a genuine choice to accept/refuse.
Running mini-case — Yacine fixes his newsletter
Yacine prospects by email from a purchased list, with no unsubscribe, and his website drops cookies with no choice. He changes method: an active box and clear information for the newsletter, an unsubscribe link in every message, a cookie banner with accept/refuse, and a simple address for access or deletion requests.
Continued from cases 3.1-3.2 — Yacine moves from 'pretence' to genuine consent.
1. Individual rights
Data protection puts the person at the centre. The main rights: information, access (a copy of one's data), rectification, erasure ('right to be forgotten', under conditions), objection, restriction, portability.
They are not absolute (exceptions: legal obligations, third-party rights) but they are real: the organisation must make them easy to exercise (contact channel, response within deadlines).
2. Consent
One legal basis among others, but the most demanding. Valid consent must be free, specific, informed, unambiguous (a positive act — an active box, not pre-ticked), and revocable just as easily as it was given.
Two applications: prospecting (marketing emails: often consent + unsubscribe) and cookies for non-essential trackers (a banner offering a genuine accept/refuse choice).
3. The trust reflex
Respecting these rights is a duty AND a trust factor: a simple unsubscribe is worth more than an irritated prospect.
Check in your country the exact basis required for prospecting and cookies: procedures vary, fairness towards people is universal.
🔎 Concrete example — 🔎 Practical example — Genuine consent
Not a pretence.
Pre-ticked box, 'accept all to continue', grouped consent → problematic.
Active box + clear information + easy unsubscribe → valid.
→ you must be able to unsubscribe just as simply as you subscribed.Result: rights respected and valid consent = trust.
Reflex: check the required basis (prospecting, cookies) in your country.
Section vocabulary
- Individual rights
- The set of rights to control one's data: information, access, rectification, erasure, objection, restriction, portability.
Simple example: A Yacine customer asking for a copy of his data.
What it is not: an absolute right with no exception at all.
Reflex: plan a simple channel and answer within deadlines.
- Right to erasure
- The right to have one's data deleted, under conditions, with exceptions (legal obligations, third-party rights).
Simple example: Yacine deletes a prospect from lists but keeps the statutory invoice.
What it is not: blindly erasing even records that must be kept.
Reflex: delete what can be, explain the rest.
- Valid consent
- A free, specific, informed and unambiguous agreement (a clear positive act); withdrawable just as easily as given.
Simple example: Active box + clear information + one-click unsubscribe at Yacine's.
What it is not: a pre-ticked box or forced consent.
Reflex: a positive act, never a pre-ticked box.
- Prospecting
- Marketing messages (especially to individuals) often requiring prior consent, with systematic unsubscribe.
Simple example: Yacine only writes to contacts who accepted, with a withdrawal link.
What it is not: buying a list and blasting with no agreement or withdrawal.
Reflex: a small consenting base rather than a big spam list.
- Cookies
- Trackers: agreement is required for non-essential trackers; the banner must offer a genuine choice (accept/refuse).
Simple example: Yacine's site offers accept and refuse on equal footing.
What it is not: an 'accept all to continue' banner with no refusal.
Reflex: a genuine choice, changeable at any time.
In practice — In practice — Respecting rights and collecting genuine consent
- Set up a simple channel for people to exercise their rights (access, rectification, erasure, objection) and answer within deadlines.
- When you rely on consent, collect it in a free, specific, informed and unambiguous way (an active, unticked box).
- Allow consent WITHDRAWAL just as easily as collection (simple unsubscribe, accessible cookie settings).
- For prospecting and cookies, check the required basis in your country and offer a genuine choice (accept/refuse).
Ready-to-say script — answering a deletion request (30 s)
'Thank you for your message. I am deleting what can be deleted from our lists and I confirm it to you. I must keep the invoice for the statutory period — I explain which one and why. Here is what has been done.'
Say or write to the customer: acknowledge, process, explain what is kept and why.
Copy-paste template — consent check
USE: _______________ (newsletter / cookies / prospecting)
FREE? _______________ | SPECIFIC? _______________
INFORMED (clear info)? _______________ | UNAMBIGUOUS (active box)? _______________
WITHDRAWAL JUST AS SIMPLE? _______________ (unsubscribe / cookie settings)
RIGHTS CHANNEL: _______________VSE / small budget
With no tool: a dedicated email address for rights + a manually maintained unsubscribe link are enough to start cleanly.
SME in Algiers
Yacine checks the local rules for prospecting and cookies: consent, unsubscribe and response deadlines suited to his country.
Purchased list
Do not use it: addresses without consent = legal and reputational risk — rebuild a consenting base, even a smaller one.
Existing website
Reconfigure the cookie banner today: accept and refuse buttons on equal footing, settings accessible in the footer.
✓ Best practices
- Plan a simple channel for exercising rights and answer within deadlines.
- Collect free, specific, informed, unambiguous consent (an active box).
- Offer a genuine choice for prospecting and cookies, with easy withdrawal.
✗ Common pitfalls
- Pre-ticked boxes or 'forced' / grouped consent.
- Making unsubscribe difficult or deceptive.
- Ignoring or answering a rights request late.
Key takeaways
- People have rights over their data: information, access, rectification, erasure, objection, restriction, portability — to be made easy to exercise.
- Consent (one legal basis among others) must be FREE, SPECIFIC, INFORMED, UNAMBIGUOUS (an active box) and REVOCABLE just as simply.
- Prospecting (marketing emails): often consent + unsubscribe; non-essential cookies: consent via a banner offering a genuine choice.
- Respecting these rights is a duty AND a trust factor; exact procedures vary by country, but fairness towards people is universal.
48h challenge — apply it tomorrow
Add one-click unsubscribe to your emails, switch 1 box to active unticked and create your rights channel (address + response deadline).
- I can cite the 4 qualities of valid consent.
- My newsletter has simple unsubscribe.
- My site offers a genuine cookie choice.
Frequently asked questions
Can I send marketing emails freely?
No, not freely: especially towards individuals, the widespread principle is prior consent ('opt-in') — no bought or scraped addresses — plus simple unsubscribe in every message. Towards professionals or existing customers (similar products with objection), some countries are more flexible. Spam also harms reputation and deliverability: a smaller but consenting base is better. Check your country's exact rules.
A customer asks to delete all his data: must I obey?
Not 100% unconditionally, but take the request seriously: delete what can be deleted (lists, useless account) and keep, while explaining, what the law imposes (invoices, dispute, ongoing contract). Acknowledge receipt, process within deadlines, document. Retention periods and exceptions vary by country, so check the applicable regime.
Valid consent must be…