For the processing of personal data, e.g. for research purposes or for sending newsletters, the consent of the data subject must be given in advance, but at the latest at the time of data collection, unless there is another legal basis (Article 6 (1) (a), Article 7 DSGVO). In order for consent to be legally effective, it must be
- Be given voluntarily
- Inform about the purposes of the data processing (the purpose limitation principle applies). The purposes must be described as specifically as possible so that the person giving consent knows to what extent consent is being given.
- Be in the form of an unambiguous statement or other unambiguous confirmatory act (if possible in writing),
- Be verifiably documented – The responsibility lies with the respective specialised procedure, which must decide on the type and duration of storage.
- As a rule, consent should be retained for as long as the personal data is processed. Only in this way can the basis for processing be proven in a legally secure manner and data subjects’ rights be exercised.
- Be formulated in clear and simple language and clearly separated from the rest of a letter (e.g. by italics, boldface, coloured highlighting, spatial separation).
- The information obligations (data protection declaration) towards the data subject must have been fulfilled at the latest at the moment of collection.
be just as easy to revoke as to grant, whereby reference must be made to the revocability at any time of the collection/processing. - Indicate that the revocation of consent does not affect the lawfulness of the processing carried out on the basis of consent until revocation. This means that processing by the HWR must only cease after the revocation. All processing activities carried out prior to this are lawful.
The higher education institution must be able to prove to the supervisory authority and the data subjects, if required, that the data processing complies with the GDPR. Even if the GDPR does not explicitly require written consent, it is advisable to obtain consent in writing as part of the obligation to provide evidence. It is advisable to hand out the data protection declaration with the consent and to have a reading confirmation signed.
Instructions on how to prepare this and a sample consent form can be found here.