Article 7
Conditions for consent
There is no recital in the Directive related to article 7.
Regulation
Art. 7 1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data. 2. If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding. 3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. 4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. |
Directive
Art. 7 Member States shall provide that personal data may be processed only if: (a) the data subject has unambiguously given his consent; or (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or (c) processing is necessary for compliance with a legal obligation to which the controller is subject; or (d) processing is necessary in order to protect the vital interests of the data subject; or (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed; or (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1). |
Spain
Article 6. Consent of the data subject.- Organic Law on the Protection of Personal Data 1. Processing of personal data shall require the unambiguous consent of the data subject, unless laid down otherwise by law. 2. Consent shall not be required where the personal data are collected for the exercise of the functions proper to public administrations within the scope of their responsibilities; where they relate to the parties to a contract or preliminary contract for a business, employment or administrative relationship, and are necessary for its maintenance or fulfilment; where the purpose of processing the data is to protect a vital interest of the data subject under the terms of Article 7(6) of this Law, or where the data are contained in sources accessible to the public and their processing is necessary to satisfy the legitimate interest pursued by the controller or that of the third party to whom the data are communicated, unless the fundamental rights and freedoms of the data subject are jeopardised. 3. The consent to which the Article refers may be revoked when there are justified grounds for doing so and the revocation does not have retroactive effect. 4. In the cases where the consent of the data subject is not required for processing personal data, and unless provided otherwise by law, the data subject may object to such processing when there are compelling and legitimate grounds relating to a particular personal situation. In such an event, the controller shall exclude the data relating to the data subject from the processing. Article 12. General principles.- Royal Decree 1720/2007 Implementing the Organic Law on the Protection of Personal Data.- 1. The data controller shall obtain the data subject’s consent for the processing of his personal data except in those situations where it does not have to be obtained pursuant to that provided at law. The request for consent shall refer to specific processing or series of processes, stating the purpose for which they are collected, as well as the other conditions applying to the processing or series of processes. 2. When consent of the data subject is requested for the assignment of his data, he shall be informed in such a way as to understand unequivocally the purpose for which the relevant data shall be used and the type of activity performed by the recipient. Otherwise, consent shall be null and void. 3. The data controller shall be responsible for proving the existence of the data subject’s consent by any means of legally admissible evidence. |