What is Freely Given Consent?
Freely given consent is consent that is given by a data subject who has real, genuine choice and control.
Freely Given => Must be Informed
Consent must be informed to be freely given. The controller must inform the data subject, among other things, about the consent withdrawal right. Without that information, consent is not freely given on the data subject side because the data subject does not have a genuine choice. The data subject could feel coerced and locked in.
Freely Given => No Compulsion
Consent is not freely given if there is any element of compulsion, pressure or inability to exercise free will.
Freely Given => Without Detriment
Refusal of consent or withdrawal of consent must be without detriment. The controller must demonstrate that is possible for the data subject to refuse or withdraw consent without detriment. Consent is not freely given if the data subject suffers a detriment when consent is withheld.
Freely Given => Just-as-Easy to Withdraw
The controller must tell the data subject of the right to withdraw consent, and the exercise of the right to withdraw consent must be just as easy having given consent in the first place. The controller has the burden to show that the data subject was informed of the right to withdraw, and that it is just as easy to withdraw as give, without detriment to the data subject.
Freely Given => Cannot be Bundled
Bundled consent (of multiple purposes in one consent) is invalid. Too vague or general consent requests are invalid. The controller should provide granular consent requests to meet requirements of both freely given and specific, including detail on the purpose of processing. Consent is not freely given if several purposes for processing are bundled into one consent.
Freely Given => Affirmative Action
Consent requires a clear affirmative action on behalf of the data subject. This means a deliberate action to consent to a particular processing. A controller cannot use consent by default, like pre-ticked consent check-boxes. It is possible to use browser settings for consent in some circumstances where real choice is preserved. Controllers should use labels that clearly express consent to a specific processing.
Freely Given => Not Freely Given When Imbalance of Power
An imbalance of power in favor of the controller (e.g., employer) makes the consent suspect of not being freely given.
Freely Given => Not by Freely if Unnecessary to Contract
Consent is not freely given if performance of a contract is conditional on unnecessary consent.
Freely Given => Must be Distinguished
Consent is not freely given if embedded in a written declaration that concerns other matters, not clearly distinguishing among them, as where it is inserted into the legalese of a long privacy policy.