Westin Global Privacy Surveys

The Westin Research Center has created a network of national rapporteurs who will be available to answer common questions about complying with global privacy law. These international surveys, which are organized by the Westin Research Center, channel the experience of experts in the respective jurisdictions. They do not constitute—nor should be used as a substitute for—legal advice. They do not reflect the opinion of the Westin Research Center.

SURVEY 1: IS CONSENT TO A PRIVACY STATEMENT VALID IF THE STATEMENT IS DRAFTED IN ENGLISH, OR MUST IT BE TRANSLATED TO YOUR LOCAL LANGUAGE?

Argentina

Rapporteur:
Pablo A. Palazzi

The data protection law does not require consent to be written in Spanish, so a consent can be in English.

Austria

Rapporteur:
Axel Anderl

In general, consent declarations in English are not illegitimate per se. They depend on the effective foreign language skills and understanding of the data subjects involved, as data subjects have to freely give unambiguous consent based upon full information.

Belgium

Rapporteur:
Catherine Erkelens

Consent to data processing on the basis of an English privacy policy is valid if the data subject fully understands it before their consent is given (i.e. it is “informed consent”). Consent must also be unambiguous and freely given.

China

Rapporteur:
Grace Chen

Yes it could be valid; there is no specific prohibition against the use of a foreign language.

Czech Republic

Rapporteur:
Vojtech Chloupek

Consent to an English language privacy policy would be valid. However, even if using English for the privacy statement does not necessarily mean the statement is invalid, translation to Czech is generally highly recommended.

Denmark

Rapporteur:
Nis Peter Dall

Generally, any language will do. However, consent is defined as “any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data related to him being processed.” The key word being “informed.” Danish language statements will generally be expected to be understood (unless the wording is in itself incomprehensible), but depending on the audience English may be fine.

Finland

Rapporteur:
Eija Warma

As a general rule, privacy statements should be communicated in language that can be easily understood by the target group of a service. The feasibility of the English language depends on the English knowledge of the target group of a particular service, i.e. to whom the service is directed.

France

Rapporteur:
Ariane Mole

Consent to a privacy statement is not valid if the statement is drafted in English. To be valid, it must be translated into the local language.

Germany

Rapporteur:
Fabien Niemann
Stefan Schuppert

According to Section 4(a) of the German Data Protection Act, consent must be given in an informed manner, meaning the data subject must be aware of the purpose and the extent of the data processing he or she is consenting to.

With regard to this requirement, a consent can be given in English (or any other language) if the data subject is capable of understanding this language. If the corresponding service offering is (in total or in material parts) available (also or only) in German, then an English privacy statement will likely not be seen as sufficient by German courts and, hence, the respective consent will not be effective. In these cases, a translation of the privacy policy should be made.

Hong Kong

Rapporteur:
Marcus Vass

It depends. The overriding principle is that data collection shall be fair. It may be regarded as unfair to provide English privacy statements to readers not proficient in English.

Israel

Rapporteur:
Pini Azaria

There are no formal language requirements. Under the Privacy Protection Act, 1981, consent may be express or implied, but must be "informed." If a privacy statement is not provided in Hebrew, the controller would face an evidentiary burden to prove consent was informed.

Italy

Rapporteur:
Marco Berliri
Debora Stella

Consent to an English language privacy statement is invalid unless the data subject fully understands the language (which is unlikely to be valid to the general audience).

Japan

Rapporteur:
Hiroshi Miyashita

There is no provision or policy on a linguistic requirement. But it is normally understood that the statement must be translated into Japanese; otherwise the statement may be regarded as a disadvantageous contract that unilaterally impairs the interests of consumers, which is prohibited by Article 10 of the Consumer Contract Act. The general Japanese audience cannot be expected to read an English privacy statement.

Netherlands

Rapporteur:
Gerrit-Jan Zwenne

Consent to an English language privacy statement would be valid, provided that the data subject indeed understands the language of the privacy statement. Note, however, that accepting a privacy statement that has some consent wording may not qualify as unambiguous consent, as it is not certain whether the data subject actually has read and understood the consent wording. Layered consent is acceptable.

In general, under Polish law a privacy statement understood as a consent for the processing of personal data does not require translation into Polish (except when the consent is given by a consumer or employee).

Portugal

Rapporteur:
Ana Rita Painho

Consent to an English language privacy statement could be considered valid. However, the Data Privacy Commission requires a Portuguese translation of all documents provided.

Russia

Rapporteur:
Natalia Gulyaeva

The Russian law on personal data does not provide a direct requirement to obtain consents from individuals in Russian. However, since the official language of the territory of Russia is Russian, in case of audits or interaction with the state authorities, as well as in case of disputes in courts, such documents are reviewed in Russian.

Spain

Rapporteur:
Gonzalo Gállego

There are no specific rules on the language of consent. However, as a general rule, the consent must be informed. This means that the data subject must be aware of the processing that will take place before granting the consent. Otherwise, the consent is not valid.

For such reasons, in Spain, consents tend to be in Spanish. Otherwise, there is a risk that the data subject may argue that the consent was not understandable. Yet, strictly speaking, there is no such requirement and depending on the circumstances, and English consent may be completely appropriate (e.g., the mother tongue of the data subject is English although he or she lives in Spain, or the consent is collected in a meeting of a U.S. or English association in Spain where the language used in all sessions is English, etc.)

Sweden

Rapporteur:
Ida Smed Sörensen

There is no statutory obligation to translate information into Swedish. However, the controller carries the burden of proof that the data subject has understood the information provided (upon which the consent is based) and it is therefore strongly recommended that information is translated into Swedish if the controller is not certain that the data subject’s understanding of English is sufficient.

Switzerland

Rapporteur:
Sylvain Métille

Consent to an English language privacy statement would be valid if the subject correctly understood the information provided in English.

United Arab Emirates

Rapporteur:
Warren Thomson

There is no requirement for consents (or other written agreements or documents between private parties) to be in Arabic unless the statement is required by the parties to be notarized, and consent to an English privacy statement generally would be valid.

Argentina

Rapporteur:
Pablo A. Palazzi

A statement in English may be valid, but it is advisable to have it in Spanish.

Austria

Rapporteur:
Axel Anderl

As long as the employee is capable of understanding the scope of the consent declaration (i.e., English is used as a daily business language), an English language privacy policy is sufficient.

Belgium

Rapporteur:
Catherine Erkelens

The statement should be in a language understood by the employee. Special language legislation requires employment documents to be drafted in the language of the region in Belgium where the employer is seated. Considering the uneven balance of powers between employers and employees, to the extent that employee consent is not easily “freely” given such consent is not taken into account, most of the time.

China

Rapporteur:
Grace Chen

Yes, it could be valid.

Czech Republic

Rapporteur:
Vojtech Chloupek

Yes, it could be valid.

Denmark

Rapporteur:
Nis Peter Dall

Yes, it could be valid (e.g., if the subjects are employees in a company where the day-to-day language is English).

Finland

Rapporteur:
Eija Warma

Privacy statements should be communicated in a language that can be easily understood by the employees. Thus, the use of the employees’ mother tongue is not an absolute requirement. For example, if the company’s language is English and knowledge of English is required in the company, a privacy statement can be in English too.

France

Rapporteur:
Ariane Mole

Article L.1321-6 of the French Labor Code requires that “any document providing obligations to the employee or any provision the knowledge of which is necessary for the execution of his work must be written in French.” Therefore, a privacy statement would be considered as necessary for the execution of the employee’s work and must be written in French. However, please note that under French labor law it is very likely that consent to a privacy statement would not be considered as valid anyway, even in French, since consent is not considered as a legal basis for processing when it is given by an employee.

Germany

Rapporteur:
Fabien Niemann
Stefan Schuppert

It depends on the nature of the employment. Similar considerations apply: if the employee’s working language is English and his employee contract is in English, an English privacy statement is likely sufficient. Otherwise, a translation should be made.

However, to be valid, consent must be given freely. The relationship between employee and employer is characterized by a certain hierarchy which in general prevents the employee from freely deciding about such consent. Against this background, an employee’s consent is in general no valid justification to process personal data in the course of the employment contract.

Hong Kong

Rapporteur:
Marcus Vass

It depends on the English proficiency of the employee.

Israel

Rapporteur:
Pini Azaria

In a workplace where English is used as a work language, an English statement would typically suffice. Otherwise, if a privacy statement is not provided in Hebrew, the controller would face an evidentiary burden to prove consent was informed.

Italy

Rapporteur:
Marco Berliri
Debora Stella

Consent to an English language privacy statement could be valid, provided that the employee speaks or understands English.

Japan

Rapporteur:
Hiroshi Miyashita

Guidelines on privacy protection in employment management say “it is necessary that the contents of [contracts or statements] shall be reasonable and appropriate enough to recognize by the data subject” (Article 18, Section 2). English statements are not likely to be “reasonable and appropriate” for the ordinary Japanese workplace.

Netherlands

Rapporteur:
Gerrit-Jan Zwenne

Consent is always tricky when it comes to employees, as it is not clear whether they have the freedom to deny consent. Leaving that aside, if the employee understands the language, consent can be valid.

The Polish Language Act requires the employer to provide all communication regarding the employee’s rights and obligations, including a consent for data processing, in Polish or bilingual form. Violators are subject to up to 30 days in jail, restriction of freedoms, fines up to PLN 5000 or reprimands.

Further, the Polish Data Protection Act generally requires that consent be clear, and there is a risk that such consent to an English statement by a person who is not fluent in the language could be considered invalid.

Portugal

Rapporteur:
Ana Rita Painho

Consent would be considered valid if the consent document includes that the employee has full knowledge of the English language and understands the contents of the consent provided.

However, collection and processing on the basis of consent is restricted, since the Data Protection Commission has generally adopted the view that employees, due to their subordinate position, have no capacity to provide truly free consent.

Russia

Rapporteur:
Natalia Gulyaeva

Statements should be translated into Russian.

Spain

Rapporteur:
Gonzalo Gállego

The same as the general rule. The fact that the data subject is an employee may make it easier to make a risk assessment on whether he or she will understand an English consent (e.g., if the employee needs English in order to perform his or her task, etc.).

Sweden

Rapporteur:
Ida Smed Sörensen

It should also be noted that employees are generally not considered to be able to provide valid consent as they are in a dependent position in relation to their employer. Valid consent from employees requires a real free choice, i.e. that there is a real option not to consent and that there is no direct or indirect pressure from the employer to consent.

Switzerland

Rapporteur:
Sylvain Métille

Consent to an English language privacy statement would be invalid. The consent of an employee is rarely accepted, as an employee is not in a position to refuse.

United Arab Emirates

Rapporteur:
Warren Thomson

Consent to an English privacy statement would be valid.

Argentina

Rapporteur:
Pablo A. Palazzi

A statement in English may be valid, but it is advisable to have it in Spanish.

Austria

Rapporteur:
Axel Anderl

As long as the customer is capable of understanding the scope of the consent declaration (i.e., English is used as a general contracting language), an English language privacy statement is sufficient.

Belgium

Rapporteur:
Catherine Erkelens

The consent is only valid if the data subject fully understands the statement before consent is given. As the burden of proof for “informed consent” lies with the data controller, it would be necessary to produce evidence that the consumer understands English and gave “informed consent,” which can be difficult. Most consumers in Belgium are not English speakers, so it is advisable to use local languages. Usually, privacy statements are in the language used for advertising the service or product.

China

Rapporteur:
Grace Chen

Yes, it could be valid.

Czech Republic

Rapporteur:
Vojtech Chloupek

Yes, it could be valid. However, according to new Czech legislation, effective as of January 1, 2014, all announcements towards consumers need to be in the same language as a concluded consumer contract. According to Czech consumer law, consumers should generally be informed about various things in the Czech language.

Denmark

Rapporteur:
Nis Peter Dall

Yes, it could be valid. However, generally there cannot be the same expectation in relation to language skills as for employees.

Finland

Rapporteur:
Eija Warma

The regulation is somewhat stricter than for employees. Generally, all merchandising information provided for the purpose of making a purchase decision should be available in a clear and understandable manner for consumers.

Finland has two national languages: Finnish and Swedish. Thus, privacy statements should be in both Finnish and Swedish if a service is directed towards Finnish consumers at large, and not only towards a limited group of potential customers possessing special expertise where the use of English or the use of either Finnish or Swedish may well be grounded. In addition, if the concerned service is not merchandised in Finland or directed towards Finnish consumers, the national language requirement does not apply.

France

Rapporteur:
Ariane Mole

Article L.121-66 of the French Consumer Code requires that “the contract must be written in French when the consumer resides in France or the professional sells on the French territory.” Consent to a privacy statement would be considered as part of the contractual relationship with the consumer, and therefore would need to be in French.

Germany

Rapporteur:
Fabien Niemann
Stefan Schuppert

The general rule is that it depends on the language of the corresponding service. If the controller processing the data can ensure that the data subject was capable of understanding an English consent declaration, such consent can be given in English.

However, it is unlikely that all relevant offerings, marketing materials, etc., will be in English in a business-to-consumer service which targets the German market. Therefore, usually, a translation of the privacy policy is required in business-to-consumer transactions.

Hong Kong

Rapporteur:
Marcus Vass

It depends on the English proficiency of the consumer.

Israel

Rapporteur:
Pini Azaria

If a privacy statement is not provided in Hebrew, the controller would face an evidentiary burden to prove consent was informed.

Italy

Rapporteur:
Marco Berliri
Debora Stella

Use of the Italian language is mandatory for all contractual information in the case of consumers.

In Italy, a consent is invalid unless the data subject fully understands the language.

Japan

Rapporteur:
Hiroshi Miyashita

It is normally understood that the statement must be translated into Japanese; otherwise the statement may be regarded as a disadvantageous contract that unilaterally impairs the interests of consumers, which is prohibited by Article 10 of the Consumer Contract Act.

Netherlands

Rapporteur:
Gerrit-Jan Zwenne

If the consumer understands the language, then consent would be valid. In the Netherlands, most people have a basic understanding of English (but obviously all are not at the same level).

The standard is the same as for employees; the Polish Language Act requires the entrepreneur to provide all communication regarding consumer's rights and obligation, including a consent for data processing, in Polish or bilingual form. Privacy statements should generally be provided in Polish or bilingual form.

Portugal

Rapporteur:
Ana Rita Painho

Consent would be considered valid if the consent document includes that the consumer has full knowledge of the English language and understands the contents of the consent provided.

However, while this could technically be admissible, there are strong reservations to the use of a foreign language for consent, since it is hard to assess at the moment of retrieval whether the consumer indeed understood the language at the time of consent.

Russia

Rapporteur:
Natalia Gulyaeva

Statements should be translated into Russian.

Spain

Rapporteur:
Gonzalo Gállego

The same as the general rule. However, note that, generally speaking, it is not possible to assume that consumers in Spain understand English. Therefore, a consent addressed to consumers in general should be in Spanish. There are some exceptions to this rule (e.g., information provided in a hotel to English customers, etc.).

Sweden

Rapporteur:
Ida Smed Sörensen

If the controller can show that the data subject understood an English statement, consent could be valid.

Switzerland

Rapporteur:
Sylvain Métille

Consent to an English language privacy statement would be valid, if the subject correctly understood the information provided in English.

United Arab Emirates

Rapporteur:
Warren Thomson

Consent to an English privacy statement would be valid.

Argentina

Rapporteur:
Pablo A. Palazzi

No additional comments.

Austria

Rapporteur:
Axel Anderl

No additional comments.

Belgium

Rapporteur:
Catherine Erkelens

The Belgian Data Protection Authority tends to refer, in relation to consent, to Article 29 Working Party opinions and applicable EU case law.

China

Rapporteur:
Grace Chen

While there is no express prohibition against the use of English, translation to Chinese would be advisable to avoid the situation where the employee or consumer claims he or she did not give consent because he or she did not understand what he or she was consenting to.

Czech Republic

Rapporteur:
Vojtech Chloupek

Regarding the privacy statement, the Czech language is not mandatory. However, it is highly recommended as controllers need to prove that the data subjects understood the privacy statement. There are only a few exceptions when the English wording would be acceptable – e.g., if the data subject is fluent in English because it is a basic requirement for a particular job position, etc.

Denmark

Rapporteur:
Nis Peter Dall

No additional comments.

Finland

Rapporteur:
Eija Warma

In addition to the language requirements, it is recommended consents to a privacy policy be obtained in a written form, as the data controller has the burden of proof of the existence of a valid contract.

As to the language requirement, the use of the English language is not prohibited as such. However, as described earlier, consideration of the language requirement should be case-specific, depending on the target group of a particular service.

France

Rapporteur:
Ariane Mole

The Toubon Act of 1994 provided for an obligation to use the French language in contracts. This legal provision cannot be overridden even by consent from the individual. Failure to use the French language is punishable by fines, but moreover documents which are not written in French are not considered as enforceable against consumers or employees.

Germany

Rapporteur:
Fabien Niemann
Stefan Schuppert

Irrespective of the language, German law puts particularly strong requirements on privacy consents (they must be specific, transparent, opt-in, etc.).

It is required that the declaration is provided to the data subject in a way that enables the data subject to understand the purposes and the extent of the data processing intended. The burden of proof if the consent declaration was given validly lies with the controller processing the data. Thus, the controller has to ensure that the data subject understood what he/she consented to. Against this background it will be often advisable to translate a consent declaration if German customers are asked for their consent

Hong Kong

Rapporteur:
Marcus Vass

English and Chinese are the two official languages of Hong Kong. It is common for privacy statements to be provided in both languages.

Israel

Rapporteur:
Pini Azaria

No additional comments.

Italy

Rapporteur:
Marco Berliri
Debora Stella

Although the Italian data protection legislation does not expressly require that consent (and notice) be given in Italian, based on the general principles underlying the Italian legal system, if the data subject does not have sufficient understanding of the English language he or she may claim the unenforceability of such consent.

However, consent is not mandatory for all processing activities. For instance, processing of data to perform a contract does not require consent. Marketing activities always require prior consent.

Japan

Rapporteur:
Hiroshi Miyashita

The Japanese Privacy Act does not mention privacy statements, but the Basic Policy of the Protection of Personal Information Act says “it is desirable to develop and publicize privacy policies.” “Desirable,” of course, is not mandatory. A 2012 study by the Japanese government indicates that 61.3% of Japanese businesses publicize privacy statements, 11.3% have a nonpublic privacy statement, and 25.7% have no privacy statement at all (study in Japanese).

Netherlands

Rapporteur:
Gerrit-Jan Zwenne

No additional comments.

The Polish Data Protection Act does not explicitly provide for that a privacy statement needs to be drafted in Polish; hence, it can be made in English also. However, provisions of other acts (e.g., the Polish Language Act) require the Polish language is used in dealings with employees and consumers.

Portugal

Rapporteur:
Ana Rita Painho

No additional comments.

Russia

Rapporteur:
Natalia Gulyaeva

No additional comments.

Spain

Rapporteur:
Gonzalo Gállego

No additional comments.

Sweden

Rapporteur:
Ida Smed Sörensen

It should be noted that there are other legal bases for the processing in addition to consent that could be applicable (e.g., that the processing is necessary in order to fulfill an agreement with the data subject).

Switzerland

Rapporteur:
Sylvain Métille

Consent is only valid if freely given and based on adequate information (this includes that the information be in an understandable language for the data subject).

United Arab Emirates

Rapporteur:
Warren Thomson

There is no requirement for consents (or other written agreements or documents between private parties) to be in Arabic unless the statement is required by the parties to be notarized (in which case the document will need to be presented for notarization either in Arabic, or bilingually in Arabic and another language with the Arabic translation stamped by the Ministry of Justice).

Also, if a matter becomes the subject of a dispute before any of the onshore courts of the UAE (excluding the DIFC Courts), any documents that are being adduced in evidence will need to be translated into Arabic, and the Arabic translation stamped by the Ministry of Justice.

The IAPP Westin Research Center extends its greatest thanks to the rapporteurs who generously shared their time and expertise to produce this survey.