4. (1) Where processing is based on consent in accordance with section 32 of the Act, a data controller or data processor shall, in seeking consent prior to the processing, inform the data subject of’—
(a) the identity of the data controller or data processor;
(b) the purpose of each of the processing operations for which consent is sought;
(c) the type of personal data that is collected and used;
(d) information about the use of the personal data for automated decision-making, where relevant;
(e) the possible risks of data transfers due to absence of an adequacy decision or appropriate safeguards;
(f) whether the personal data processed shall be shared with third parties;
(g) the right to withdraw consent; and
(h) the implications of providing, withholding or withdrawing consent.
(2) The information under sub-regulation (1) may be presented to the data subject through a written notice, oral statement, audio or video message.
(3) In obtaining consent from a data subject, a data controller or a data processor shall ensure that the—
(a) data subject has capacity to give consent;
(b) data subject voluntarily gives consent; and
(c) consent is specific to the purpose of processing.
(4) Pursuant to section 32(4) of the Act, consent shall be considered to have been given freely, unless where —
(a) it is presumed on the basis that the data subject did not object to a proposal to processing of their personal data in a particular manner;
(b) it is presented as a non-negotiable part of the terms and conditions for processing;
(c) the data subject is unable to refuse or withdraw their consent without detriment;
(d) the data controller or data processor merges several purposes for processing without seeking specific consent for each purpose; or
(e) the intention of the data subject is ambiguous.
(5) Where the data subject withdraws consent to any part of the processing, the data controller or data processor shall restrict the part of the processing in respect of which consent is withdrawn, subject to section 34 of the Act.
