In this case, the organization can assume that the individual's request constitutes consent for specific purposes. Consent shall not be obtained through deception. The way in which an organization seeks consent may vary, depending on the circumstances and the type of information collected. An organization should generally seek express consent when the information is likely to be considered sensitive. Implied consent would generally be appropriate when the information is less sensitive.
Individuals can give consent in many ways.
An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. The organization shall inform the individual of the implications of such withdrawal. The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means. 4.4.1 Organizations shall not collect personal information indiscriminately.