The requirements of consent
The first requirement of consent is that the consent is a free expression of will.This means that consent is only valid if the person concerned has been able to make a genuine choice and if there has been no risk of deception, intimidation, coercion or significant negative consequences as a result of giving consent.
In addition, consent must be a specific expression of will, which is fulfilled if the consent clearly and precisely refers to the scope and consequences of the processing of personal data.
The requirement of informed consent is fulfilled if the data subject is aware of the identity of the controller and the purpose of the processing of the personal data. This means that the data subject should be fully informed in a clear and understandable manner on all relevant issues, such as the nature of the data processed, the purpose of the processing, any recipients, etc. It also means that the data subject must be aware of the consequences of not giving consent to the processing of personal data.
Important in the context of informed consent is the quality of the information with which the controller informs the data subject and the accessibility and visibility of this information. The information should be provided directly to the data subject.
The last element of a valid consent based on the GDPR, is the requirement of unambiguity of the expression of will. This means that the procedure of asking the person concerned for consent must show that the person concerned had the intention to give consent and that there is no doubt about this.
Other conditions for consent
In addition to the elements listed above which, if met, constitute consent within the meaning of the GDPR, there are a number of other conditions if consent is requested from a data subject for the processing of his or her personal data.
If the processing of personal data is based on consent, the data controller is obliged to be able to prove that the data subject has indeed given consent.
If consent to process the personal data is based on a written statement in which other matters are also agreed upon, it is important that the specific request for consent by the data controller in this document is clearly distinguishable from the rest of the contract, that its form is comprehensible and easy to understand, and that its language is also easily understandable.
In addition, the data subject should have the possibility to withdraw the consent given at any time, which should be easy to do.
Consent and children
The processing of children's personal data is subject to specific protection, as children are likely to be much less aware of the risks, consequences and safeguards and of their rights in relation to the processing of their personal data. In particular, if the consent is used to process personal data for marketing purposes, if it is used for profiling purposes or if the personal data relating to children are processed when using services provided directly to children, specific protection applies. The applicable regulations vary from country to country and from situation to situation.
For example, in the case of the provision of a service which is normally paid for and which is provided remotely, electronically and at the request of the recipient of a service, e.g. in online shops, use of certain social media, or streaming of a football website, stricter rules apply to children. When the child is under 16 years of age, the consent is only valid if given by the parents or if the consent is approved by the parents.
When it comes to children's consent, not every country is in agreement. For example, the age for requiring parental consent or approval varies. In general, however, it can be concluded that a child's consent is subject to stricter requirements.