Guidelines 05/2020 on Consent under Regulation 2016/679 (GDPR)

Paragraph 3.3.1  Minimum content requirements for consent to be ‘informed’

64. For consent to be informed, it is necessary to inform the data subject of certain elements that are crucial to make a choice. Therefore, the EDPB is of the opinion that at least the following information is required for obtaining valid consent:

• i. the controller’s identity,

• ii. the purpose of each of the processing operations for which consent is sought,

• iii. what (type of) data will be collected and used,

• iv. the existence of the right to withdraw consent,

• v. information about the use of the data for automated decision-making in accordance with Article 22 (2)(c) where relevant, and

• vi. on the possible risks of data transfers due to absence of an adequacy decision and of appropriate safeguards as described in Article 46.

65. With regard to item (i) and (iii), the EDPB notes that in a case where the consent sought is to be relied upon by multiple (joint) controllers or if the data is to be transferred to or processed by other controllers who wish to rely on the original consent, these organisations should all be named. Processors do not need to be named as part of the consent requirements, although to comply with Articles 13 and 14 of the GDPR, controllers will need to provide a full list of recipients or categories of recipients including processors. To conclude, the EDPB notes that depending on the circumstances and context of a case, more information may be needed to allow the data subject to genuinely understand the processing operations at hand.