They are pretty great, beyond the examples brought up here. For instance, on the criterion free/freely given, they write the following:
> The element “free” implies real choice and control for data subjects. As a general rule, the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid.13If consent is bundled up as anon-negotiable part of terms and conditions it is presumed not to have been freely given. Accordingly,consent will not be considered to be free if the data subject is unable to refuse or withdraw his or her consent without detriment.14The notion of imbalance between the controller and the data subject is also taken into consideration by the GDPR.
Regarding the last element they cite the examples of public authorities or employment (e.g. monitoring systems) as situations where there is an imbalance of power that may limit the ability to give consent freely (there are other bases for processing data).
Also, I want to quickly remind HN that the GDPR applies to any data processing and goes far beyond consenting to cookies but also to, e.g., any other tracking, "selling" the email address to an advertising firm, taking a video of you, etc.
They are pretty great, beyond the examples brought up here. For instance, on the criterion free/freely given, they write the following:
> The element “free” implies real choice and control for data subjects. As a general rule, the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid.13If consent is bundled up as anon-negotiable part of terms and conditions it is presumed not to have been freely given. Accordingly,consent will not be considered to be free if the data subject is unable to refuse or withdraw his or her consent without detriment.14The notion of imbalance between the controller and the data subject is also taken into consideration by the GDPR.
Regarding the last element they cite the examples of public authorities or employment (e.g. monitoring systems) as situations where there is an imbalance of power that may limit the ability to give consent freely (there are other bases for processing data).
Also, I want to quickly remind HN that the GDPR applies to any data processing and goes far beyond consenting to cookies but also to, e.g., any other tracking, "selling" the email address to an advertising firm, taking a video of you, etc.