RGPD-Expert-1.5B

Quels sont les droits des personnes concernées sous le RGPD et comment les exercer ?

What are the GDPR requirements for data breach notification?

What are the requirements for valid consent under GDPR?

Consent under GDPR (Article 4.11 definition, Article 7 conditions) must meet 5 cumulative criteria:
**Freely given, Specific, Informed, Unambiguous, and Revocable**.

---

**1. Freely Given** (Article 7.4)

**Definition**: Genuine choice and control, no pressure or consequences

**Requirements**:
- **No detriment if refused**: Refusal must not result in disadvantage
- **No bundling**: Consent for one purpose cannot be bundled with consent for unrelated purposes
  (cannot make newsletter consent mandatory to create account)
- **No imbalance of power**: Employer-employee, doctor-patient = problematic (GDPR Recital 43)

**Examples**:
- ❌ "Tick to receive newsletter to complete registration" (bundled, not free)
- ❌ "Accept all cookies or leave the site" (not free - no genuine choice)
- ✅ "Subscribe to newsletter (optional)" with unchecked box
- ✅ Granular cookie choices (strictly necessary vs. analytics vs. marketing)

**Imbalance of power**:
- Public authorities cannot rely on consent (use legal obligation or public interest instead)
- Employers should avoid consent (use legitimate interest or contract)

---

**2. Specific** (Article 6.1.a, Recital 32)

**Definition**: Consent must be purpose-specific (separate consent for each purpose)

**Requirements**:
- One consent per distinct purpose
- No "blanket consent" for vague processing

**Examples**:
- ❌ "I consent to the processing of my data" (too vague)
- ❌ "I agree to data processing for marketing and analytics" (bundled, should be separate)
- ✅ Separate checkboxes:

**Special category data** (Article 9): Requires **explicit consent** + specific purpose
- ❌ "I consent to health data processing"
- ✅ "I consent to processing my blood test results for diabetes diagnosis"

---

**3. Informed** (Article 13-14, Recital 42)

**Definition**: Data subject must have clear understanding of what they consent to

**Mandatory information BEFORE consent**:
1. **Identity** of data controller (company name)
2. **Purposes** of processing (what will you do with the data?)
3. **Types of data** collected (email, IP address, cookies, etc.)
4. **Right to withdraw** consent at any time
5. **Recipients** (third parties who will receive data)
6. **Automated decision-making** if applicable (profiling, algorithms)
7. **(If applicable) International transfers** (data sent outside EU)

**Presentation**:
- Clear and plain language (no legalese)
- Easily accessible (not buried in 50-page T&Cs)
- Layered approach recommended (short summary + link to full privacy policy)

**Example**:

Dans quels cas une DPIA est-elle obligatoire selon le RGPD et comment la réaliser ?

What are the requirements for transferring personal data outside the EU under GDPR?

Quelles sont les règles concernant les cookies et le consentement selon le RGPD et la directive ePrivacy ?