Consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR is one of the grounds for permission to lawfully process personal data. The consent of a data subject is only valid if it has been given
- voluntarily (Art. 4 no. 11 GDPR),
- if the data subject was informed (Art. 4 no. 11 GDPR),
- if it is unambiguous (Art. 4 no. 11 GDPR) and
- if it relates to one or more specific purposes (Art. 6 para. 1 sentence 1 lit. a) GDPR)
- as well as to a specific case of processing (Art. 4 no. 11 GDPR).
The consent is only voluntary if the data subject has a genuine or free choice and is therefore in a position to refuse or withdraw the consent without suffering any disadvantages. Informed consent requires that the data subject at least knows who the controller is and for what purposes his or her personal data will be processed.
In addition, the data subject must be informed of his or her right to revoke the consent as well as any consequences connected with this revocation, pursuant to Art. 7 para. 3 sentence 3 GDPR. The characteristic of unambiguity requires a clear confirmatory act with which the consent is granted. The reference of the consent to one or more specific purposes as well as to a specific case of processing excludes the granting of a so-called “blanket consent”. The burden of proof regarding the granting of consent lies with the controller (Art. 7 para. 1 GDPR). The data subject may revoke his or her consent at any time, but this does not affect the lawfulness of the processing on the basis of the consent up to the time of such revocation (Art. 7 para. 3 sentences 1 and 2 GDPR).