A signup form includes a single pre-ticked box labelled “I agree to all processing and international transfers” with no destination, risks, or purpose detail. If the company wants to rely on consent as an Article 49 transfer derogation, what is wrong?
Select an answer to reveal the explanation.
Short Explanation
Consent for sending data abroad has to be a clear, informed yes—not a dusty pre-ticked “agree to everything” trap. Bundling transfers into a mystery blob fails the specificity test. Spell out what moves where and why, and let people make a real choice.
Full Explanation
Where explicit consent is used under Article 49 for transfers lacking adequacy and Article 46 safeguards, data subjects must be informed of possible risks and the consent must meet GDPR quality standards—freely given, specific, informed, and unambiguous. Pre-ticked, bundled, or non-specific transfer consents are defective. Describing risks is part of informed consent, not forbidden, and payment-card data are irrelevant to validity.