How implicit consent works for them and not us

I recently wrote about data protection, arguing that organisations don’t grasp the idea that adults can live together and make shared decisions. The default assumption is that you do not consent to any third party ringing up about your account, and it’s usually impossible to prove your consent without putting in more effort than it would take to make the call yourself in the first place.

However, the Data Protection Act does contain the concept of implicit consent for businesses, allowing them, for example, to send you marketing material on the assumption that if you haven’t explicitly opted out, you must be fine with it.

Where it gets interesting (and by “interesting” I mean “really bad for the consumer”) is when these two concepts collide.

My husband and I used to have a joint home contents insurance policy with UIA Insurance. After a few years we became unhappy with UIA (for reasons I won’t go into here) and decided to switch to a different insurance provider.

I rang up to cancel the policy, only to be told that UIA couldn’t cancel it without my husband’s consent. No, it wasn’t good enough for me to say that it was a joint decision; he had to make his own, separate request to cancel.

Before he got round to it, UIA wrote to us to say that the policy, which was due to expire some six weeks later, would be renewed. Why? Because we hadn’t told them otherwise, so they were taking our silence as implicit consent for renewal. Of course, a phone call saying “Please cancel our policy” doesn’t sound much like silence to a reasonable person, but UIA is an organisation, not a person, and it doesn't have to behave reasonably, just lawfully.

My husband cancelled the direct debit with the bank and contacted UIA to request cancellation in no uncertain terms.

...We have now received a letter through the post stating that you will not merely *not* be cancelling the policy, but you will be *renewing* the policy, without our permission, effective 17 November.

With this ludicrous state of affairs in mind: as she has already requested of you, please cancel this policy, effective immediately...

...Given you did not explicitly obtain permission to set this policy up in my name, it makes me boggle that you would then require both of us to request to cancel it before doing so, and that you will even automatically renew a policy after its holders have asked you to cancel it altogether. Whoever is in charge of your security procedures needs to concern themselves more with security and less with the mere appearance of security.

Our experience is a neat illustration of how implicit consent benefits organisations at the expense of individuals. UIA had the right to assume our implicit consent for policy renewal because I didn’t have the right to assert my husband’s implicit consent to cancelling it. They assumed a “yes” on the flimsy grounds that we hadn’t both jumped through the “no” hoops; they were able to do that because my single “no” had had no effect. It doesn’t matter if the two policy-holders have signed a publicly-witnessed contract to spend their lives together; it’s still OK, legally, to demand consent severally for changes to the joint policy.

Of course, as my husband’s letter pointed out, the need for his explicit consent somehow didn’t apply when it came to setting up the insurance policy in the first place. Businesses get to pick and choose when to assume implicit consent, so it’s no surprise that they assume it when the customer's decision is in their interest but require explicit consent when it’s not.