Informed consent to sensitive personal data processing for the performance of digital consumer contracts on the example of “23andMe”

Consent to the processing of sensitive personal data and contractual agreements are generally considered not to come into close contact. Legal relationships are based on either one or the other – with, e. g., consent governing the relationship between researcher and research subjects, and contract governing the relationship between service provider and consumer. When it comes to contracts and consent to personal data processing, the latter is not needed if personal data processing is necessary for the performance of a contract to which the data subject is a party to or in order to take steps at the request of the data subject prior to entering into a contract. However, when it comes to sensitive personal data, freely given explicit and informed consent is required regardless of the contract or intention to enter into one. Furthermore, when dealing with cases in which processing of sensitive personal data is at the core of the contractual subject (e. g. service contracts for the analysis and/or interpretation of genetic data), consent and contract become intertwined. Regrettably, issues that arise in theory regarding the interconnectedness of contract and consent appear to be avoided in practice by ignoring requirements regarding consent. (EuCML 2017, 17, beck-online)