Requirement
For information requiring explicit consent, the entity communicates the need for such consent as well as the consequences of a failure to provide consent for the request for personal information and obtains the consent prior to the collection of the information to meet the entity’s objectives related to privacy.
Points of Focus
Informs Data Subjects of Consequences of Failure to Provide Consent [C]
Requirement: Data subjects are informed of the consequences of failing to provide the entity with explicit consent.
Documents Explicit Consent to Retain Information [C]
Requirement: Documentation of explicit consent for the collection, use, or disclosure of sensitive personal information is retained to support the achievement of entity objectives related to privacy.
Explanation
When explicit consent is required, individuals must be told why it is needed and what refusing means, and the consent must be obtained before the information is collected. Auditors expect retained documentation proving that explicit consent — especially for sensitive personal information — was actually captured before collection took place.
