Our remarks • When relying on consent as a legal basis, several • It is crucial for data controllers to provide adequate connected requirements must be met. One of these information to data subjects about the different is that data subjects should be able to give consent ways personal data may be processed, before to different processing purposes individually and after its trade. This includes clear information (granulated consent), rather than accepting about the categories of recipients of personal a single agreement where several processing data, allowing data subjects to identify partners purposes are ‘bundled’ together. Note also that of the data controller. When distributing products it must be as easy for the data subject to revoke through hospitals and gynecologists, it is possible their consent as it is to grant it in the first place. that individuals may get a misleading impression It is advisable to inform the data subjects of their about the entities involved. Specifically, they right to withdraw consent at the time of obtaining may perceive Family Service as a non-profit it. Once consent is withdrawn, the data controller organization or a governmental initiative rather must ensure that the data is erased, unless there than a private company that trades personal data. is another legal basis for processing the data. Therefore, companies should be transparent about Please consult GDPR, Articles 4(11) and 7 for more the advantages associated with the exchange of information on what constitutes valid consent personal data. under the Regulation. • Data controllers must consider the reasonable expectations and interests of data subjects when determining the validity of a legitimate interest as a legal basis, ensuring that the legitimate interest aligns with the expectations of the data subjects. Data controllers should refrain from using abstract language, but instead explicitly describe the activities for which personal data is processed, such as targeted advertising. This transparency is essential for data subjects to understand how their personal data may be used by other entities and to exercise control over their personal data. Please consult GDPR, Article 6(1)(f) for more information about legitimate interests as a legal basis. 84