Lawfulness of processing
Where processing is based on consent, the controller must be able to prove that the data subject has given consent to the processing of their personal data.
If the data subject gives consent as part of a written statement that also relates to other matters, the request for consent shall be presented in an intelligible and easily accessible form and in clear and simple language in such a way that it can be clearly distinguished from the other matters. If any portion of such a statement constitutes a violation of this regulation, that portion shall not be binding.
The data subject has the right to withdraw consent at any time. The withdrawal of consent shall not affect the lawfulness of the processing based on the consent before its withdrawal. Before giving consent, the data subject shall be notified. Withdrawing consent is as simple as giving it.
In assessing whether consent may be freely given, one of the strongest considerations is whether the performance of a contract, including a service contract, requires consent to a processing of personal data that is not necessary for the performance of that contract.
