CIPM Consent Management Flashcards

Under GDPR, which conditions must ALL be met for consent to be considered lawful?

Answer: Consent must be freely given, specific, informed, and unambiguous

GDPR Article 7 requires valid consent to be freely given, specific, informed, and unambiguous, typically demonstrated through a clear affirmative act.

What does 'freely given' consent mean in the GDPR framework?

Answer: Consent not conditioned on a service unless processing is necessary for that service

Freely given consent means there is no power imbalance and service delivery is not conditioned on consent to processing that is unnecessary for that service.

Under GDPR, how must consent be obtained to process children's data for information society services?

Answer: Parental or guardian consent for children under 16 (or lower national threshold)

GDPR requires parental or guardian consent for children under 16 for information society services, though member states may lower this threshold to 13.

What is the primary purpose of a Consent Management Platform (CMP)?

Answer: To collect, store, and manage records of user consents

A CMP helps organizations obtain, record, and manage user consents, enabling them to demonstrate compliance and honor consent withdrawal requests.

Under GDPR, can consent be used as a valid legal basis when there is a significant power imbalance between controller and data subject?

Answer: No, because consent cannot be considered freely given in such situations

When a clear power imbalance exists, such as between an employer and employee, consent is generally not considered freely given and thus is not a valid legal basis.

Which of the following constitutes an 'unambiguous indication' of consent under GDPR?

Answer: Actively ticking an unticked checkbox

An unambiguous indication requires a clear affirmative act, such as ticking an unticked checkbox; passive behavior and pre-selected options do not meet this standard.