Take-Aways (AI)
- According to the GDPR, personal data processing requires a legal basis, e.g. consent pursuant to Art. 6(1)(a), Art. 9(2)(a), Art. 49(1)(a).
- In the case of consent, the necessary (risk) information, specificity, form, voluntariness, documentation and revocation must be clarified.
- Concrete requirements relate in particular to the question of the necessary specificity and comprehensible documentation of consent.
- The Thuringian State Commissioner published a concise, clear template for the declaration of consent as a customizable sample solution.
According to Art. 5(1)(a), Art. 6, Art. 9 f. and, if applicable, Art. 44 ff. DSGVO, the processing of personal data requires a legal basis. This can consist of consent (Art. 6(1)(a), Art. 9(2)(a) and Art. 49(1)(a) GDPR), whereby the question then arises in each case, among other things, which (risk) indications are required, how specifically the consent must be explained, in what form it must be available, whether it is voluntary, how it must be documented and how it can be revoked.
The Thuringian State Commissioner for Data Protection has now issued a Consent Form Template which is comparatively concise and clear and can certainly be used as a template (to be adapted).