Data Protection No. 24 of 2019 [Subsidiary] THE DATA PROTECTION (GENERAL) REGULATIONS, 2021 [Legal Notice 263 of 2021] PART I – PRELIMINARY 1. Citation These Regulations may be cited as the Data Protection (General) Regulations, 2021. 2. Interpretation In these Regulations, unless the context otherwise requires— “Act” means the Data Protection Act, 2019 (No. 24 of 2019); “Data Commissioner” means the person appointed as such pursuant to section 6 of the Act; and “Office” has the meaning assigned to it under the Act. 3. Exemption These Regulations shall not apply to civil registration entities specified under the Data Protection (Civil Registration) Regulations, 2020 (L.N. 196/2020). PART II – ENABLING THE RIGHTS OF A DATA SUBJECT 4. Processing on the basis of consent (1) Where processing is based on consent in accordance with section 32 of the Act, a data controller or data processor shall, in seeking consent prior to the processing, inform the data subject of— (a) the identity of the data controller or data processor; (b) the purpose of each of the processing operations for which consent is sought; (c) the type of personal data that is collected and used; (d) information about the use of the personal data for automated decisionmaking, where relevant; (e) the possible risks of data transfers due to absence of an adequacy decision or appropriate safeguards; (f) whether the personal data processed shall be shared with third parties; (g) the right to withdraw consent; and (h) the implications of providing, withholding or withdrawing consent. (2) The information under sub-regulation (1) may be presented to the data subject through a written notice, oral statement, audio or video message. (3) In obtaining consent from a data subject, a data controller or a data processor shall ensure that the— (a) data subject has capacity to give consent; (b) data subject voluntarily gives consent; and (c) consent is specific to the purpose of processing. (4) Pursuant to section 32(4) of the Act, consent shall be considered to have been given freely, unless where — (a) it is presumed on the basis that the data subject did not object to a proposal to processing of their personal data in a particular manner; (b) it is presented as a non-negotiable part of the terms and conditions for processing; (c) the data subject is unable to refuse or withdraw their consent without detriment; 19