Should You Rely on Partner Consent for Special Category Data?

You're processing personal data through a third-party platform. Your partner claims they've obtained user consent. Your legal team signs off on the data processing agreement. You're compliant, right?

Not according to the Norwegian Data Protection Authority (DPA), which fined Xandr EUR 8.6 million. The regulator's message is clear: as a joint controller under the General Data Protection Regulation, you can't outsource accountability for consent validation.

The Decision You're Facing

Your organization processes personal data through partnerships, advertising platforms, or shared data arrangements. You must decide: do you independently verify that consent meets GDPR requirements, or do you rely on your partner's assurance that they've obtained valid consent?

This isn't theoretical. The Xandr enforcement shows regulators expect each joint controller to verify consent independently, especially when processing special category data under Article 9(1).

Key Factors That Affect Your Choice

Data sensitivity determines your risk exposure. If you're processing special category data (health information, sexual orientation, biometric data, racial or ethnic origin), Article 9(2)(a) requires explicit consent. Standard Article 6(1)(a) consent won't suffice. The Norwegian DPA found that Xandr processed data revealing sexual orientation without valid explicit consent.

Your role in the processing chain matters. Are you a controller, processor, or joint controller? Joint controllers share responsibility for determining purposes and means of processing under Article 26. The Norwegian DPA classified Xandr as a joint controller, meaning Xandr couldn't claim it was merely executing instructions.

The consent mechanism's validity is verifiable. Articles 4(11) and 7 require that consent be freely given, specific, informed, and unambiguous. You can audit whether consent mechanisms meet these standards. If your partner's consent flow fails Article 7 requirements, your processing remains unlawful even with a signed agreement.

Regulatory scrutiny varies by sector and data type. Real-time bidding, location data, and profiling attract heightened attention. If your processing involves Automated Individual Decision-Making and Profiling under Article 22, expect regulators to examine consent validity closely.

Path A: Independent Consent Verification (When You're a Joint Controller Processing Special Category Data)

Choose this path if:

• You determine processing purposes jointly with partners
• You process Article 9(1) special category data
• You operate in high-scrutiny sectors (adtech, health tech, dating platforms)
• Your processing involves cross-border data flows
• You can't directly observe how consent is obtained

Implementation requirements:

Request technical documentation of your partner's consent mechanism. Review the actual consent language users see, not just contractual representations. Verify that consent requests are granular enough to cover your specific processing activities.

Conduct regular audits of consent validity. The Norwegian DPA emphasized that accountability can't be outsourced. Build quarterly reviews into your joint controller agreement under Article 26. Document your verification process.

Implement technical controls to validate consent signals. If you receive consent indicators through APIs or data feeds, verify they include timestamp, scope, and withdrawal mechanism data. Your systems should reject processing requests lacking valid consent signals.

Establish clear withdrawal procedures. Article 7(3) requires that withdrawing consent must be as easy as giving it. If your partner controls the user interface, ensure you can honor withdrawal requests independently.

Risk if you don't: The Norwegian DPA classified violations as "at least negligent" and noted they concerned "some of the most central provisions in the GDPR." An EUR 8.6 million fine represents roughly 1.7% of Xandr's estimated annual turnover in the relevant market. For special category data violations, Article 83(5) permits fines up to EUR 20 million or 4% of global annual turnover, whichever is higher.

Path B: Documented Reliance on Partner Consent (When You're a Processor with Limited Processing Scope)

Choose this path if:

• You process data solely on documented instructions (Article 28)
• You're a processor, not a controller or joint controller
• You don't determine processing purposes or means
• You process only standard personal data categories (not Article 9 special categories)
• You have contractual indemnification for consent-related claims

Implementation requirements:

Document your processor status explicitly. Your Article 28 data processing agreement must specify that you process only on instructions. Any deviation from instructions converts you into a controller under Article 28(10).

Require contractual warranties about consent validity. While this doesn't eliminate your compliance obligations, it establishes the controller's responsibility to provide lawful instructions.

Implement instruction validation procedures. If a controller instructs you to process data in ways that appear unlawful, Article 28(3)(h) requires you to inform them. Build processes to flag potentially unlawful instructions.

Limitations of this path: You remain liable for your own processing activities. If you repurpose data, combine it with other datasets, or determine retention periods independently, you've likely crossed into controller territory. The Norwegian DPA's analysis shows regulators examine actual processing activities, not just contractual labels.

Path C: Obtaining Your Own Consent (When You Control User Touchpoints)

Choose this path if:

• You operate user-facing platforms or applications
• You want maximum control over consent validity
• You process special category data for multiple purposes
• You anticipate regulatory audits or certification requirements
• Your business model depends on demonstrable consent

Implementation requirements:

Design consent interfaces that meet Article 7 requirements. Separate consent requests by processing purpose. Avoid pre-ticked boxes. Use clear, plain language explaining what data you'll collect and how you'll use it.

Implement a Consent Management Platform that records consent scope, timestamp, withdrawal requests, and user identity. Your records must demonstrate compliance under Article 7(1), which places the burden of proof on controllers.

Establish processes for consent refresh. While the GDPR doesn't specify consent expiration periods, regulators expect you to revalidate consent when processing purposes change or significant time passes.

Summary Matrix

The Norwegian DPA's enforcement against Xandr establishes a clear precedent: joint controllers can't hide behind partnership agreements when consent fails Article 7 requirements. If you're processing special category data through partnerships, independent verification isn't optional, it's your accountability obligation under the GDPR.