<Li> To protect the vital interests of a data subject or another person . </Li> <P> If informed consent is used as the lawful basis for processing, consent must have been explicit for data collected and each purpose data is used for (Article 7; defined in Article 4). Consent must be a specific, freely - given, plainly - worded, and unambiguous affirmation given by the data subject; an online form which has consent options structured as an opt - out selected by default is a violation of the GDPR, as the consent is not unambiguously affirmed by the user . In addition, multiple types of processing may not be "bundled" together into a single affirmation prompt, as this is not specific to each use of data, and the individual permissions are not freely - given . (Recital 32) </P> <P> Data subjects must be allowed to withdraw this consent at any time, and this process must be as easy as it was to originally opt in . (Article 7 (3)) A data controller may not refuse service to users who decline consent to processing that is not strictly necessary in order to use the service . (Article 7 (4)) Consent for children, defined in the regulation as being less than 16 years old (although with the option for member states to individually make it as low as 13 years old (Article 8 (1)), must be given by the child's parent or custodian, and verifiable (Article 8). </P> <P> If consent to processing was already provided under the Data Protection Directive, a data controller does not have to re-obtain consent if the processing is documented and obtained in compliance with the GDPR's requirements (Recital 171). </P>

Experts seek national data protection act as eu gdpr takes effect today