Consent is one of the legal grounds for processing of personal data. Whenever processing is based on consent, the controller must be able to demonstrate that the data subject has agreed to the processing of his or her personal data.
Consent has to be freely given
The consent is valid, only if it has been freely given. It is not regarded as freely given, if:
1) the data subject has no genuine or free choice or;
2) the data subject is unable to refuse or withdraw consent without detriment;
3) there is a clear imbalance between the data subject and the controller;
4) the data subject has not a possibility to give separate consent to different personal data processing operations despite it is appropriate in the individual case;
5) the performance of a contract, including the provision of a service, is dependent on the consent despite such consent is not being necessary for such performance.
Consent should be done in an intelligible and easily accessible form, using clear and plain language
Consent may be given in various forms. It complies with the law to include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Generally, a written form of the consent may not be required. However silence, pre-ticked boxes or inactivity are not treated as constituting consent. Remember that some Member State law may require written form of consent.
Data subject has a right to withdraw consent
The consent may be withdrawn at any time, and the data subject should be aware of that prior to giving his or her consent. The withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal. It shall be as easy to withdraw as to give consent.