In order to assess whether an instance of given consent is valid thus requires keeping records of information regarding how the consent was obtained i.e. using the notice, and how the consent is being utilised i.e. the processing enabled through that consent. This same information is also required for the organisation to determine whether its processing activities should continue, e.g. depending on whether a particular user has given consent and whether it is still valid (e.g. hasn't expired or wasn't withdrawn). Such information that is documented and maintained regarding consent is called a Consent Record.
+ +Where the information is to be communicated to another entity, it can be provided in the form of a Consent Receipt, which is an authoritative copy of the consent record - similar to how a shopping transaction involves a merchant's copy and a receipt provided to the customer. Such receipts may provide only an acknowledgement of the transaction or also involve specifics of the contents of that transaction. Consent records have been a common practice within organisations for a while now, especially given their requirement in laws such as GDPR Article 7 - however the issuing of consent receipts is a relatively new and under explored activity.
[[[ISO-27560]]] is a Technical Specification (TS) that "specifies an interoperable, open and extensible information structure" for recording the data subject's consent to processing of their personal data i.e. as consent records, and to provide this information i.e. as consent receipts. The specification lists information fields that represent specific information associated with consent, and requirements over the form this information can take e.g. format, number of values, and whether it is mandatory or optional to be present. A [[ISO-27560]] conformant implementation is one that fulfils all requirements by either storing information in the form prescribed by [[ISO-27560]], or by storing information in a form that can be converted or transformed to fulfil its requirements.
-[[ISO-27560]] allows for changes to made to the fields, for example to suit and match domain-specific labels or descriptions, or to introduce additional fields or information types that are needed. Such changes, expressed as schemas or profiles, are still required to be compatible with the requirements of [[ISO-27560]], such as by requiring the same fields to be mandatory. This document, referred to as [[DPV-27560]], is a schema or profile of [[ISO-27560]], and is intended to enable the use of [[DPV]] to represent information for the implementation of consent records and receipts.
+[[ISO-27560]] allows for changes to be made to the fields, for example to suit and match domain-specific labels or descriptions, or to introduce additional fields or information types that are needed. Such changes, expressed as schemas or profiles, are still required to be compatible with the requirements of [[ISO-27560]], such as by requiring the same fields to be mandatory. This document, referred to as [[DPV-27560]], is a schema or profile of [[ISO-27560]], and is intended to enable the use of [[DPV]] to represent information for the implementation of consent records and receipts.
diff --git a/guides/consent-27560.html b/guides/consent-27560.html index cd9cad6cd..63f36574c 100644 --- a/guides/consent-27560.html +++ b/guides/consent-27560.html @@ -571,11 +571,17 @@In order to assess whether an instance of given consent is valid thus requires keeping records of information regarding how the consent was obtained i.e. using the notice, and how the consent is being utilised i.e. the processing enabled through that consent. This same information is also required for the organisation to determine whether its processing activities should continue, e.g. depending on whether a particular user has given consent and whether it is still valid (e.g. hasn't expired or wasn't withdrawn). Such information that is documented and maintained regarding consent is called a Consent Record.
+ +Where the information is to be communicated to another entity, it can be provided in the form of a Consent Receipt, which is an authoritative copy of the consent record - similar to how a shopping transaction involves a merchant's copy and a receipt provided to the customer. Such receipts may provide only an acknowledgement of the transaction or also involve specifics of the contents of that transaction. Consent records have been a common practice within organisations for a while now, especially given their requirement in laws such as GDPR Article 7 - however the issuing of consent receipts is a relatively new and under explored activity.
[[[ISO-27560]]] is a Technical Specification (TS) that "specifies an interoperable, open and extensible information structure" for recording the data subject's consent to processing of their personal data i.e. as consent records, and to provide this information i.e. as consent receipts. The specification lists information fields that represent specific information associated with consent, and requirements over the form this information can take e.g. format, number of values, and whether it is mandatory or optional to be present. A [[ISO-27560]] conformant implementation is one that fulfils all requirements by either storing information in the form prescribed by [[ISO-27560]], or by storing information in a form that can be converted or transformed to fulfil its requirements.
-[[ISO-27560]] allows for changes to made to the fields, for example to suit and match domain-specific labels or descriptions, or to introduce additional fields or information types that are needed. Such changes, expressed as schemas or profiles, are still required to be compatible with the requirements of [[ISO-27560]], such as by requiring the same fields to be mandatory. This document, referred to as [[DPV-27560]], is a schema or profile of [[ISO-27560]], and is intended to enable the use of [[DPV]] to represent information for the implementation of consent records and receipts.
+[[ISO-27560]] allows for changes to be made to the fields, for example to suit and match domain-specific labels or descriptions, or to introduce additional fields or information types that are needed. Such changes, expressed as schemas or profiles, are still required to be compatible with the requirements of [[ISO-27560]], such as by requiring the same fields to be mandatory. This document, referred to as [[DPV-27560]], is a schema or profile of [[ISO-27560]], and is intended to enable the use of [[DPV]] to represent information for the implementation of consent records and receipts.