Usual and expected data processing should be allowed by law. Since the processing of personal data is the norm in a digital world, a generous rather than restrictive standard should be applied to the interpretation of legal bases to justify data processing.

If necessary, this could be combined with opt-out possibilities for the data subject.

Only for processing that cannot reasonably be expected should consent (opt-in) be relied on as an exception. However, this assessment would have to take into account widespread digital innovations. The GDPR also knows the criterion of "reasonable expectations". However, it is underdeveloped there.

Such a reform of data protection law would not abolish the current precautionary principle, but it would modify it considerably.