Requirement
The entity communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information to the data subjects and the consequences, if any, of each choice. Explicit consent for the collection, use, retention, disclosure, and disposal of personal information is obtained from data subjects or other authorized persons, if required. Such consent is obtained only for the intended purpose of the information to meet the entity’s objectives related to privacy. The entity’s basis for determining implicit consent for the collection, use, retention, disclosure, and disposal of personal information is documented.
Points of Focus
Communicates to Data Subjects [C]
Requirement: Data subjects are informed (a) about the choices available to them with respect to the collection, use, and disclosure of personal information and (b) that implicit or explicit consent is required to collect, use, and disclose personal information, unless a law or regulation specifically requires or allows otherwise.
Communicates Consequences of Denying or Withdrawing Consent [C]
Requirement: When personal information is collected, data subjects are informed of the consequences of refusing to provide personal information or denying or withdrawing consent to use personal information for purposes identified in the notice.
Obtains Implicit or Explicit Consent [C]
Requirement: Implicit or explicit consent is obtained from data subjects at or before the time personal information is collected or soon thereafter. The individual’s preferences expressed in his or her consent are confirmed and implemented.
Documents and Obtains Consent for New Purposes and Uses [C]
Requirement: If information that was previously collected is to be used for purposes not previously identified in the privacy notice, the new purpose is documented, the data subject is notified, and implicit or explicit consent is obtained prior to such new use or purpose.
Obtains Explicit Consent for Sensitive Information [C]
Requirement: Explicit consent is obtained directly from the data subject when sensitive personal information is collected, used, or disclosed, unless a law or regulation specifically requires otherwise.
Obtains Consent for Data Transfers [C]
Requirement: Consent is obtained before personal information is transferred to or from an individual’s computer or other similar endpoint device.
Explanation
People must be told what choices they have over their personal information and what happens if they refuse, and the organization must obtain consent — explicit where required, such as for sensitive data — before collecting or using it. Auditors verify consent is captured, documented, and honored, including for new purposes and data transfers.
