Redundant data or UNION
You can use solution 2, but you should have a stronger INSERT logic validation, to check whether data has already a policy or not.

So it would be something like: 


check for law rules first (applies to all your users) check for user
consent rule (user specific, so you have to relate it to userID)


So you can use tables: User, DataCollectionPurpose(a flag for law or user consent) and Consent(so you will join to it where your flag in the other table is for user consent)

Hope this helps!