(Informed) Consent is an important legal basis as it provides control and empowerment to data subjects or users based on the ability to choose and make decisions. Privacy and data protection laws such as [EU-GDPR] regulate this process by defining conditions for when consent should be considered Valid Consent. The process of Informed Consent requires information be provided in the form of a Consent Notice to inform the data subject about the processing that will occur based on the consent and to enable them to make an informed choice or decision.
In order to assess whether an instance of given consent is valid thus requires keeping records of information regarding how the consent was obtained i.e. using the notice, and how the consent is being utilised i.e. the processing enabled through that consent. This same information is also required for the organisation to determine whether its processing activities should continue, e.g. depending on whether a particular user has given consent and whether it is still valid (e.g. hasn't expired or wasn't withdrawn). Such information that is documented and maintained regarding consent is called a Consent Record.
Where the information is to be communicated to another entity, it can be provided in the form of a Consent Receipt, which is an authoritative copy of the consent record - similar to how a shopping transaction involves a merchant's copy and a receipt provided to the customer. Such receipts may provide only an acknowledgement of the transaction or also involve specifics of the contents of that transaction. Consent records have been a common practice within organisations for a while now, especially given their requirement in laws such as GDPR Article 7 - however the issuing of consent receipts is a relatively new and under explored activity.
ISO/IEC TS 27560 Privacy technologies — Consent record information structure is a Technical Specification (TS) that "specifies an interoperable, open and extensible information structure" for recording the data subject's consent to processing of their personal data i.e. as consent records, and to provide this information i.e. as consent receipts. The specification lists information fields that represent specific information associated with consent, and requirements over the form this information can take e.g. format, number of values, and whether it is mandatory or optional to be present. A [ISO-27560] conformant implementation is one that fulfils all requirements by either storing information in the form prescribed by [ISO-27560], or by storing information in a form that can be converted or transformed to fulfil its requirements.
[ISO-27560] allows for changes to made to the fields, for example to suit and match domain-specific labels or descriptions, or to introduce additional fields or information types that are needed. Such changes, expressed as schemas or profiles, are still required to be compatible with the requirements of [ISO-27560], such as by requiring the same fields to be mandatory. This document, referred to as [DPV-27560], is a schema or profile of [ISO-27560], and is intended to enable the use of [DPV] to represent information for the implementation of consent records and receipts.
Processing of personal data utilises Consent as one of the possible legal bases. In the current regulatory environment, such consent has to be valid according to several criterion such as being informed, freely given, and being unambiguous. For consent to be informed, the data subject must have been provided or be aware of relevant information regarding the processing of personal data, typically through a Consent Notice, which describes the effect of their decision i.e. if consent is given which processing activities will take place, over which data, and who is involved in terms of entities. Other criterion, such as freely given and being unambiguous is determined through the manner in which this information is presented to request consent and how that consent is expressed.
Once a consent has been given by the individual, they may also have the ability to regulate its use by withdrawing it at a later time. Such termination of consent results in the halting of its associated processing activities. Other causes of termination can be the expiry of duration for which the consent would be considered valid, termination by the Controller, or the consent being declared invalid by an authority such as the court.
Based on these, a lifecycle can be charted regarding the various states that 'consent' can be stated to be in, which is essential to understand which states can be considered 'valid' for the processing of personal data. In the diagram below, consent states begin with a notice being shown to inform the individual and request their consent. Following this, the individual may make the decision to give or grant their consent, or to refuse it. If consent has been given, it can be re-confirmed or re-affirmed to assert its validity, or it can be terminated for several reasons such as its withdrawal by the individual. In all these, only when consent continues to be in a 'given' state can it be used to justify processing.
Therefore, when creating records of consent - such as to demonstrate compliance, it is essential to not only have information regarding the processing activities governed by that consent, but to also have information which relates to determination of it being valid at a given time. This includes how the notice was provided, the type of consent that was expressed, and to associate these with relevant regulatory requirements that dictate the requirements for validity. In addition, changes to consent must also be recorded, whether they relate to an update to information resulting in a new notice, or the confirmation of an existing consent, or the termination of consent for reasons such as being withdrawn.
The following are the objectives of this document:
The scope of this document is defined as follows:
- The implementation of [DPV-27560] is limited to information represented within a consent record, and the information on how a notice is provided (beyond a link to the notice) or matching the contents of a notice to that of a consent record is outside the scope of this work. Those interested in notices should refer to the work being developed under DPV Profile for implementing ISO/IEC TS 29184:2020 Privacy Notices.
- [DPV-27560], like [ISO-27560] and [DPV] is intended to be jurisdiction-agnostic. Use of specific jurisdictional concepts and requirements such as those provided in this document for [EU-GDPR] require the use of appropriate DPV extensions such as [EU-GDPR].
- [DPV-27560] is limited to the representation of information as defined by [ISO-27560]. The security, communication, and maintenance of this information is outside the scope of this document.
- [DPV-27560], like [ISO-27560], is intended to facilitate interoperability of information and to ensure the required information is available in a form that can be used for its verification of conformance and compliance. Information described using [DPV-27560] can be maintained in a compatible form by an organisation for purposes such as alignment with internal terminology, processes, and technologies. Describing such compatible implementations beyond the guidance provided is outside the scope of this document.
The terminology used in [ISO-27560], [EU-GDPR], and [DPV] differ in terms or labels used, but largely represent similar semantic concepts. For example, ISO terminology uses PII for Personally Identifiable Information, which is similar to personal data in GDPR and DPV. This guide uses the [DPV] terminology unless referring to specific fields or terms used in a particular document. To assist with understanding and applying the terminologies across these three sources, 8. Mappings of Terms provides a summary table mapping the terms.
