Consent ‐ Technical Specifications

This section outlines the functionalities and processes related to managing consent within the data ecosystem. Consent plays a crucial role in ensuring that end-users have control over the sharing and usage of their data. The protocols and components within this section facilitate the collection, verification, storage and revocation of consents in a secure and compliant manner.

Consent Manager

The Consent Manager component enables end-users to give their consent to share their data amongst ecosystem participants. It provides a user-friendly interface or API that allows individuals to provide explicit consent for data exchanges. The consent manager also ensures the privacy and security of consent-related information including encryption and storage measures.

This component should be able to communicate with the catalog and contract components to run verifications on available datasets to share and services to use to have the ability to present consent information to the end-user.

Consents should be generated and stored under the Kantara Consent Receipt format, which is an open standard designed to provide individuals with a record of their consent and the necessary information to manage their consent manually. The use of the Kantara Consent Receipt standard offers several benefits for different stakeholders involved in a data space such as being compatible with the GDPR, designed to improve digital privacy for both consumers and businesses and is designed to be interoperable allowing different systems to exchange and understand consent-related information under a common format.

Kantara Consent Receipt JSON-LD example

{
  "@context": "https://kantarainitiative.org/consent-context/v1",
  "@type": "ConsentReceipt",
  "receiptToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb25zZW50S2V5IjoiMTIzNDU2Nzg5MCIsInB1cmNoYXNlTGlzdCI6...",
  "consentTimestamp": "2023-06-27T12:34:56Z",
  "dataController": {
    "name": "John Doe",
    "contactInformation": {
      "email": "johndoe@email.com",
      "address": "abc"
    }
  },
  "purpose": [
    {
      "id": "Purpose_1",
      "text": "To use skills data"
    },
    {
      "id": "Purpose_2",
      "text": "To send with Email"
    }
  ],
  "dataCategory": [
    {
      "id": "DataCategory_1",
      "text": "Hard Skills"
    },
    {
      "id": "DataCategory_2",
      "text": "Sensitive Personal Information"
    }
  ],
  "trustedService": [
    {
      "id": "TrustedService_1",
      "text": "To receive training offers"
    },
    {
      "id": "TrustedService_2",
      "text": "To Advertise"
    }
  ]
}

Consent Verification

To enhance integrity and authenticity of the consent, its verification is a crucial functionality of the data space. The verification component ensures that the consent provided by participants is valid and up-to-date. It validates the authenticity and integrity of the consent data, allowing ecosystem participants to rely on the verified consent for data exchanges.

Consent Revocation Service

To comply with GDPR, end-users need to have the right to revoke their consent at any time. The consent revocation service enables individuals to revoke their previously given consent. It ensures that the revocation is recorded and propagated throughout the ecosystem, ensuring that data exchanges cease based on the revoked consent.

Consent Logging

In addition to the consent-related functionalities, the Consent Logging component records and maintains a log of all consent-related activities within the data ecosystem. This log serves as an audit trail, capturing consent-related events, including consent granting, revocation, and verification activities. It provides transparency and accountability, ensuring compliance with data protection regulations.

Consent Protocol

Consent & Data Exchange Process

The Consent Protocol outlines the processes and interactions involved in managing consent. It provides a framework for capturing, verifying and facilitating data exchanges based on explicit user consent. It ensures that data exchanges within the data ecosystem provide end-users with transparency, accountability, and control over their data.

(view full size)

Consent Revocation & Data Usage

The Consent Revocation process ensures that individuals have the ability to revoke their previously given consent for data usage within the data ecosystem. It demonstrates the importance of providing individuals with the ability to control and manage their consents within the data ecosystem.

(view full size)