§ 15 — Deemed consent

15.—(1) An individual is deemed to consent to the collection, use or disclosure of personal data about the individual by an organisation for a purpose if —(a)

the individual, without actually giving consent mentioned in section 14, voluntarily provides the personal data to the organisation for that purpose; and

(b)

it is reasonable that the individual would voluntarily provide the data.

(2) If an individual gives, or is deemed to have given, consent to the disclosure of personal data about the individual by one organisation to another organisation for a particular purpose, the individual is deemed to consent to the collection, use or disclosure of the personal data for that particular purpose by that other organisation.

(3) Without limiting subsection (2) and subject to subsection (9), an individual (P) who provides personal data to an organisation (A) with a view to P entering into a contract with A is deemed to consent to the following where reasonably necessary for the conclusion of the contract between P and A:(a)

the disclosure of that personal data by A to another organisation (B);

(b)

the collection and use of that personal data by B;

(c)

the disclosure of that personal data by B to another organisation.[40/2020]

(4) Where an organisation collects personal data disclosed to it by B under subsection (3)(c), subsection (3)(b) and (c) applies to the organisation as if the personal data were disclosed by A to the organisation under subsection (3)(a).[40/2020]

(5) Subsections (3) and (4) apply to personal data provided before 1 February 2021 by an individual to an organisation with a view to the individual entering into a contract with the organisation —(a)

on or after 1 February 2021; or

(b)

which contract was entered into before 1 February 2021 and remains in force on that date,

as if subsections (3) and (4) —

(c)

were in force when the personal data was so provided; and

(d)

had continued in force until 1 February 2021.[40/2020]

(6) Without limiting subsection (2) and subject to subsection (9), an individual (P) who enters into a contract with an organisation (A) and provides personal data to A pursuant or in relation to that contract is deemed to consent to the following:(a)

the disclosure of that personal data by A to another organisation (B), where the disclosure is reasonably necessary —(i)

for the performance of the contract between P and A; or

(ii)

for the conclusion or performance of a contract between A and B which is entered into at P’s request, or which a reasonable person would consider to be in P’s interest;

(b)

the collection and use of that personal data by B, where the collection and use are reasonably necessary for any purpose mentioned in paragraph (a);

(c)

the disclosure of that personal data by B to another organisation, where the disclosure is reasonably necessary for any purpose mentioned in paragraph (a).[40/2020]

(7) Where an organisation collects personal data disclosed to it by B under subsection (6)(c), subsection (6)(b) and (c) applies to the organisation as if the personal data were disclosed by A to the organisation under subsection (6)(a).[40/2020]

(8) Subsections (6) and (7) apply to personal data provided before 1 February 2021 by an individual to an organisation in relation to a contract that the individual entered into before that date with the organisation, and which remains in force on that date, as if subsections (6) and (7) —(a)

were in force when the personal data was so provided; and

(b)

had continued in force until 1 February 2021.[40/2020]

(9) Subsections (3), (4), (5), (6), (7) and (8) do not affect any obligation under the contract between P and A that specifies or restricts —(a)

the personal data provided by P that A may disclose to another organisation; or

(b)

the purposes for which A may disclose the personal data provided by P to another organisation.[40/2020]

—(1) An individual is deemed to consent to the collection, use or disclosure of personal data about the individual by an organisation for a purpose if —(a)

the individual, without actually giving consent mentioned in section 14, voluntarily provides the personal data to the organisation for that purpose; and

(b)

it is reasonable that the individual would voluntarily provide the data.

(2) If an individual gives, or is deemed to have given, consent to the disclosure of personal data about the individual by one organisation to another organisation for a particular purpose, the individual is deemed to consent to the collection, use or disclosure of the personal data for that particular purpose by that other organisation.

(3) Without limiting subsection (2) and subject to subsection (9), an individual (P) who provides personal data to an organisation (A) with a view to P entering into a contract with A is deemed to consent to the following where reasonably necessary for the conclusion of the contract between P and A:(a)

the disclosure of that personal data by A to another organisation (B);

(b)

the collection and use of that personal data by B;

(c)

the disclosure of that personal data by B to another organisation.[40/2020]

(4) Where an organisation collects personal data disclosed to it by B under subsection (3)(c), subsection (3)(b) and (c) applies to the organisation as if the personal data were disclosed by A to the organisation under subsection (3)(a).[40/2020]

(5) Subsections (3) and (4) apply to personal data provided before 1 February 2021 by an individual to an organisation with a view to the individual entering into a contract with the organisation —(a)

on or after 1 February 2021; or

(b)

which contract was entered into before 1 February 2021 and remains in force on that date,

as if subsections (3) and (4) —

(c)

were in force when the personal data was so provided; and

(d)

had continued in force until 1 February 2021.[40/2020]

(6) Without limiting subsection (2) and subject to subsection (9), an individual (P) who enters into a contract with an organisation (A) and provides personal data to A pursuant or in relation to that contract is deemed to consent to the following:(a)

the disclosure of that personal data by A to another organisation (B), where the disclosure is reasonably necessary —(i)

for the performance of the contract between P and A; or

(ii)

for the conclusion or performance of a contract between A and B which is entered into at P’s request, or which a reasonable person would consider to be in P’s interest;

(b)

the collection and use of that personal data by B, where the collection and use are reasonably necessary for any purpose mentioned in paragraph (a);

(c)

the disclosure of that personal data by B to another organisation, where the disclosure is reasonably necessary for any purpose mentioned in paragraph (a).[40/2020]

(7) Where an organisation collects personal data disclosed to it by B under subsection (6)(c), subsection (6)(b) and (c) applies to the organisation as if the personal data were disclosed by A to the organisation under subsection (6)(a).[40/2020]

(8) Subsections (6) and (7) apply to personal data provided before 1 February 2021 by an individual to an organisation in relation to a contract that the individual entered into before that date with the organisation, and which remains in force on that date, as if subsections (6) and (7) —(a)

were in force when the personal data was so provided; and

(b)

had continued in force until 1 February 2021.[40/2020]

(9) Subsections (3), (4), (5), (6), (7) and (8) do not affect any obligation under the contract between P and A that specifies or restricts —(a)

the personal data provided by P that A may disclose to another organisation; or

(b)

the purposes for which A may disclose the personal data provided by P to another organisation.[40/2020]