The Data Protection Act does allow for monitoring without consent, but only where that monitoring is specific and limited to an absolutely necessary purpose that overrides the rights of the data subject: for example, the detection and prevention of crime, the protection of life or limb, or the fulfilment of a legal obligation. For any other purpose, consent must be given; for that consent to be valid, it must be fully informed, freely given and freely revocable. Where consent is relied upon as the basis for data processing, the burden of proof is upon the data processor to demonstrate that the consent was legitimately given.