8.5 Right to Withdraw Consent

Individuals have the right to withdraw consent to processing which is based on their consent.

Typically withdrawal of consent won’t be an issue for surveillance and security data processing because that processing is carried out on a legitimate interest basis. Consent in the case of access control is not usually appropriate in an employment context because of the imbalance of power between employer and employee. One exception may be if the biometric access control system is optional and an alternative is provided. Failing that, the consent isn’t ‘freely given’ (and is therefore legally invalid) because the individual can’t access their place of work otherwise. In practice, they have no option except to consent if they want to do their job.