Who is obliged to collect
All data controllers when they do not have other legal bases for data processing (when data processing is not required by law and where data processing is not indispensable for concluding or executing a contract with the data subject)
From when is necessary to collect informed consents
Consents collected prior to coming into force of GDPR:
- that were not obtained independently from other legal transactions,
- which do not separate individual purposes for the processing of data that individuals can separately consent to
- and which do not allow as easy a withdrawal of the consent as its acquisition,shall not be valid after 25 May 2018.
Products
Informed consents with the following characteristics:
- clearly distinguishable from the other matters,
- in an intelligible and easily accessible form,
- using clear and plain language.
- comprising clearly stated right of the subject to withdraw consent at any time,
- with the data subject being informed thereof prior to giving consent,
- as easy to withdraw as to give consent,
- the performance of a contract, including the provision of a service, should not be conditional on consent to the processing of personal data that is not necessary for the performance of that contract.