§ 38 DSG NRW
Consent
(1)Where the processing of personal data may be carried out on the basis of consent, the controller must be able to demonstrate the consent of the data subject.
(2)Where the consent of the data subject is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language.
(3)The data subject shall have the right to withdraw consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The data subject shall be informed thereof prior to giving consent.
(4)Consent shall be valid only if it is based on the free decision of the data subject. In assessing whether consent was freely given, the circumstances of the consent must be taken into account. The data subject shall be appropriately informed about the significance of the consent, in particular about the intended purpose of the data processing, and, where a transmission is intended, about the recipients of the data. Where this is necessary under the circumstances of the individual case, or upon request by the data subject, the data subject shall also be informed about the consequences of refusing to give consent.
(5)Where special categories of personal data are processed, the consent must expressly refer to such data.