Section 26: Consent

(1) A data controller shall bear the burden of proof for establishing a data subject's consent.
(2) In determining whether consent was freely and intentionally given, account shall be taken of whether, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
(3) Silence or inactivity of the data subject shall not constitute consent.
(4) Where the processing of personal data is based on the consent of the data subject, the data subject shall be informed of the right to withdraw consent, prior to the granting of consent.
(5) The withdrawal of consent under subsection (4) shall not affect the lawfulness of data processing that occurred before the withdrawal of the consent.
(6) A request for consent shall be in clear and simple language and accessible format.
(7) Consent –
(a) shall be in the affirmative, and not based on a pre-selected confirmation; and
(b) may be provided in writing, orally, or through electronic means.