A signup form includes a single pre-ticked box labelled “I agree to all processing and international transfers” with no destination, risks, or purpose detail. If the company wants to rely on consent as an Article 49 transfer derogation, what is wrong?
Select an answer to reveal the explanation.
Short Explanation
Consent for sending data abroad has to be a clear, informed yes—not a dusty pre-ticked “agree to everything” trap. Bundling transfers into a mystery blob fails the specificity test. Spell out what moves where and why, and let people make a real choice.
Full Explanation
When explicit consent is used as an Article 49 transfer derogation, it must be specific, informed, and freely given—covering the transfer’s nature, destinations, and risks in terms the person can understand. A single pre-ticked box bundling “all processing and international transfers” without destination, risk, or purpose detail fails consent quality and is a poor derogation foundation. People dealing with civic portals or commercial signups cannot consent to an undefined world tour of their data.
Pre-ticked bundled consent is not ideal; GDPR rejects silence or pre-ticking as agreement. Transfer consent is not valid only when combined with payment-card data. Article 49 does not forbid describing transfer risks—in fact, informed consent requires meaningful information.
Exam caveat: even valid Article 49 consent is generally unsuitable as the standing tool for systematic repetitive transfers; prefer Article 45/46 mechanisms for bulk ongoing exports.
Operational check: remove pre-ticks, unbundle transfer consent from general terms, disclose destinations and risks where consent is truly used, prefer SCCs/adequacy for systematic flows, and retain evidence of any valid granular consent events.