Consent is valid only when free (no defect of will), specific as to means and purposes, informed in line with transparency, and unequivocal; where processing rests on consent for several purposes, consent must be given for each of them. It can be withdrawn at any time without reasons, through a free, quick and simple procedure similar to the one used to obtain it; withdrawal does not affect earlier processing. The Reglamento adds that where explicit consent is required the controller first informs in detail of the types of processing, purposes, retention period, protection measures and consequences; consent must show unambiguous acceptance by a statement or a clear affirmative action; silence or inaction is never consent; the controller must be able to prove consent to the Authority; consent for persons lacking capacity (including children) is given by their legal representatives; and processing of a data subject's data stops once withdrawal is received.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.