A data controller shall bear the burden of proof for establishing a data subject’s consent.