Establishes the principles of lawfulness, fairness, and transparency in the processing of personal data.
Definition
Excerpt
In accordance with the provisions of article 4.11 of Regulation (EU) 2016/679, the consent of the affected party is understood to be any expression of free, specific, informed and unequivocal will by which he accepts, either through a declaration or a clear affirmative action, the processing of personal data concerning you.
When it is intended to base the processing of data on the consent of the affected party for a plurality of purposes, it will be necessary to state specifically and unequivocally that said consent is granted for all of them.
The execution of the contract may not be made subject to the fact that the affected party consents to the processing of personal data for purposes that are not related to the maintenance, development or control of the contractual relationship.
Related cases
Banco Bilbao Vizcaya Argentaria, SA was fined by the Spanish Data Protection Authority (AEPD) for issues related to imprecise terminology, vague formulations, the absence of the option to refuse in the privacy policy, and the use of pre-ticked checkboxes to obtain consent.
Add Event Staff, S.L. was warned by the Spanish DPA (AEPD) for not obtaining separate consent for processing activities related to job search and commercial purposes.
Related deceptive patterns
The user is presented with a default option that has already been selected for them, in order to influence their decision-making.
The user wants to do something, but they are required to do something else undesirable in return.