It is true that you need to have a positive indication of consent, but it is not true that this must be obtained by the individual ticking a box.
Recital 17 of the Directive on which these Regulations are based (2002/58/EC) gives the ticking of a box on an internet site as an example of an ‘appropriate method’ to give consent but it is only an example. It is not the only method by which consent can be obtained.
Directive 95/46/EC (the Data Protection Directive on which the UK Data Protection Act is based) defines ‘the data subject’s consent’ as:
‘any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed’.
In our view, therefore, there must be some form of communication where the individual knowingly indicates consent. This may involve clicking an icon, sending an email or subscribing to a service. The crucial consideration is that the individual must fully understand that by the action in question they will be giving consent.