Determine when and how consent is to be obtained

The organization should determine and document a process by which it can demonstrate if, when and how consent for the processing of PII was obtained from... ... - Licensed content not shown -

LGPD (BRA)

Art.7: The processing of personal data may only be performed in the following scenarios: I – Through the provision of consent by the data subject; II – For the compliance with legal or regulatory obligation on the part of the controller; III – By the public administration, for the processing and shared use of data deemed as necessary for the execution of public policies outlined in laws and regulations or supported by contracts, agreements, or similar instruments, following the provisions of Chapter IV of this Law; IV – To perform studies by research organizations, ensuring, whenever possible, the anonymization of the personal data; V – When necessary for the performance of an agreement or preliminary procedures relating to an agreement to which the data subject is party, at the request of the data subject; VI – For the regular exercise of rights in court, administrative, or arbitration proceedings, considering that arbitration proceedings must follow the provisions of Law 9,307, dated of September 23, 1996 (Arbitration Law); VII – For the protection of life or the physical safety of the data subject or third party; VIII – For the protection of health, exclusively, in procedures performed by health care professionals, health services or sanitary authorities; (New wording included by Law No. 13,853 of 2019) IX – When necessary to meet the legitimate interests of the controller or third party, except in cases where the data subject’s fundamental rights and freedoms that require the protection of personal data prevail; X – For the protection of credit, including in relation to the provisions of relevant legislation. § 1 (Revoked). (New wording included by Law No. 13,853 of 2019) § 2 (Revoked). (New wording included by Law No. 13,853 of 2019) § 3 The processing of personal data whose access is public must consider the purpose, good faith, and public interest that justify its availability. § 4 The requirement to obtain consent outlined in the head provision of this Article is waived for in case of data made manifestly public by the data subject, preserving the data subject’s rights and the principles outlined in this Law § 5 Controller that obtain the consent referred to in item I of the head provision of this Article that need to communicate or share personal data with another controller must obtain specific consent from the data subject for this purpose, except in the consent waiver scenarios outlined in this Law. § 6 An eventual waiver of the requirement for consent does not relieve the processing agents from the other obligations outlined in this Law, especially the obligation to comply with the general principles and to guarantee the data subject’s rights. § 7 The subsequent processing of the personal data referred to in § § 3 and 4 of this Article may be carried out for new purposes, provided that the legitimate and specific purposes for the new treatment and the preservation of the rights of the holder are observed, as well as the principles and grounds set forth in this Law. (Included by Law No. 13,853 of 2019)
Art.8: The consent outlined in item I of Article 7 of this Law must be provided in writing or by another demonstrable mean that shows data subject’s expression of intention. § 1 If the consent is provided in writing, it must be contemplated in a clause separated from the other contractual clauses. § 2 The burden of proof demonstrating that the consent was obtained according to the provisions of this Law lies on the controller. § 3 The processing of personal data based on an irregular consent is prohibited. § 4 The consent must refer to determined purposes, and generic authorizations for personal data processing will be void. § 5 Consent may be revoked at any time through an express manifestation of the data subject, through an easy and free-of-charge process; it is ratified the processing performed under the consent previously given while there is no request for elimination, under the terms of item VI of this head provision of Article 8 of this Law. § 6 In case of changes to the information referred to in items I, II, III, or V of Article 9 of this Law, the controller must inform, in a specific and highlighted manner, the content of the referred amendment to the data subjects, whom, in cases in which their consent is requested, may revoke it if they disagree with the change.
Art.11: The processing of sensitive personal data may only be performed in the following scenarios: I – When the data subject or their legal guardian consents, in a specific and explicit manner, for specific purposes; II – Without the provision of the data subject’s consent, in scenarios in which it is indispensable for: a) The compliance with legal or regulatory obligation on the part of the controller; b) Shared processing of data deemed necessary for the execution, by the public administration, of public policies outlined in laws and regulations; c) In conducting studies by research organizations, ensuring, whenever possible, the anonymization of the personal data; d) The regular exercise of rights in court, administrative, or arbitration proceedings; considering that arbitration proceedings must follow the provisions of Law 9,307, dated of September 23, 1996 (Arbitration Law); e) The protection of life or the physical safety of the data subject or third party; f) The protection of health, exclusively, in procedures performed by health care professionals, health services or sanitary authorities; or (New wording included by Law No. 13,853 of 2019) g) Ensuring fraud prevention and data subject’s safety, in the identification and authentication process of registration in electronic systems, preserving the rights mentioned in Article 9 of this Law and except in cases where the data subject’s fundamental rights and freedoms require the protection of personal data prevail. § 1 The provisions of this Article apply to any processing of personal data that reveal sensitive personal data and that may cause damage to the data subject, with the exception of the provisions of specific laws. § 2 In cases when letters “a” and “b” of item II of the head provision of this Article are applied by public legal entities and bodies, the aforementioned waiver of consent under the terms of item I of the head provision of Article 23 of this Law will be disclosed. § 3 The communication or shared use of sensitive personal data between controllers with the purpose of obtaining economic advantages may be subject to prohibition or regulation by the National Data Protection Authority, consulting the public authorities’ sectorial bodies, within the scope of their powers. § 4 The communication or shared use of sensitive personal related to health between controllers with the purposes of obtaining economic advantages is prohibited, except when related to the provision of health services, pharmaceutical assistance and health care, provided that § 5 of this Article is observed, including auxiliary services of diagnosis and therapy, to the benefit of the data subjects’ interest, and to allow: (New wording included by Law No. 13,853 of 2019) I – data portability when the data subject requests; or (New wording included by Law No. 13,853 of 2019) II – the financial and administrative transactions resulting from the use and provision of the services referred to in this paragraph. (New wording included by Law No. 13,853 of 2019) § 5 The operators of private health care plans are prohibited from processing health data for the practice of risk selection in the engaging of any modality, as well as in the inclusion or exclusion of beneficiaries. (New wording included by Law No. 13,853 of 2019)
Art.14: The processing of personal data of children and teenagers must be performed on their best interest, under the terms of this Article and relevant legislation. § 1 The processing of personal data of children must be performed with the specific and explicit consent provided by at least one of the parents or legal guardian. § 2 In processing the data under the provision of § 1 of this Article, the controllers must permanently disclose all information regarding the types of collected data, the way they are used, and the procedures for the exercise of rights under Article 18 of this Law. § 3 The personal data of children may be collected without the consent referred to in § 1 of this Article when the collection is necessary to contact the parents or legal guardian, and data is used only once and without being stored, or to protect them, and in no case data may be given to third parties without the consent under the provisions of § 1 of this Article. § 4 Controllers must not require data subjects referred to § 1 of this Article to provide information in order to participate in games, internet applications, or other activities beyond those information strictly necessary for the activity. § 5 Controller must undertake all reasonable efforts to verify that the consent referred to in § 1 of this Article was provided by one of the parents or legal guardian of the children, considering available technology. § 6 The information on the processing of data referred to in this Article must be provided in a simple, clear and accessible manner, considering the physical-motor, perception, sensory, intellectual, and mental characteristics of the user, with the use of audiovisual resources when appropriate, in order to provide the necessary information to the parents or legal guardian and adequate information for the understanding of the children.
Art.33: The international transfer of personal data will only be permitted in the following cases: I – To countries or international organizations that offer a level of protection of personal data that is adequate to the protection provided in this Law; II – When the controller offers and proves guarantees of compliance with the principles, the rights of the data subject, and the data protection regime outlined in this Law, in the form of: a) Specific contractual clauses for a particular transfer; b) Standard contractual clauses; c) Binding corporate rules; d) Certificates, and codes of conduct regularly issued; III – When necessary for international legal cooperation between government intelligence, investigation, and prosecution bodies, according to instruments of international law; IV – When necessary for the protection of life or the physical safety of the data subject or third party; V – When authorized by the National Data Protection Authority; VI – When resulting from a commitment made in an international cooperation agreement; VII – When necessary for the execution of a public policy or the fulfillment of a government legal duty, being publicly disclosed under the terms of item I of the head provision of Article 23 of this Law; VIII – When the data subject has provided specific and highlighted consent for the transfer, with prior information on the international character of the operation, clearly distinguishing this from the other purposes; or IX – When necessary to answer to scenarios outlined in items II, V, and VI Article 7 of this Law. Sole Paragraph. For the purposes of item I of this Article, public legal entities referred to in the sole paragraph of Article 1 of Law. 12,527, dated of November 18, 2011 (Information Access Law), within the scope of their legal powers, and responsible individuals, within the scope of their activities, may request from the National Data Protection Authority an evaluation of the level of protection of personal data provided by a country or international organization.

CCPA (US, CA)

S.1798.120: (a) A consumer shall have the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. This right may be referred to as the right to opt out. (b) A business that sells consumers’ personal information to third parties shall provide notice to consumers, pursuant to subdivision (a) of Section 1798.135, that this information may be sold and that consumers have the right to opt out of the sale of their personal information. (c) A business that has received direction from a consumer not to sell the consumer’s personal information or, in the case of a minor consumer’s personal information has not received consent to sell the minor consumer’s personal information shall be prohibited, pursuant to paragraph (4) of subdivision (a) of Section 1798.135, from selling the consumer’s personal information after its receipt of the consumer’s direction, unless the consumer subsequently provides express authorization for the sale of the consumer’s personal information. (d) Notwithstanding subdivision (a), a business shall not sell the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers between 13 and 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. This right may be referred to as the “right to opt in.”