The regulatory framework requires specific consent in the case of highly sensitive personally identifiable data (voice and image)