Working through the consent section

I have been working through the potential changes to the consent (& notice) section and there are a couple of issues to discuss:

Field names

COEL-85 points out the definition of the WebTokenID field is tighter than it needs to be. The definition is easy to change but the field name could also be better. There are other fields that could more general names as well as definitions:

WebTokenID to RecordID

ConsentDate to Date

ReceiptService to RecordService

There is no requirement to change but if we wanted to do so then now is the time.

Tightness to Kantara specification

I think we are currently sitting on the fence on this issue. Our field names are not aligned (see above) but we do directly reference a number of aspects. I believe that we should continue to reference the spec in a non-normative way (giving examples) but we might want to decouple a bit more.

The V1 of the Kantara Consent Receipt specification is all but signed off. It has dropped the references to the purpose classification we previously copied over. This is now languishing on an orphan branch: http://kantarainitiative.org/confluence/display/infosharing/Appendix+CR+-+V.9.3+-+Example+Purpose+Categories

I believe that purpose definitions and categories are useful but we have no good standard to reference. I also see that under GDPR it is very likely for organisations to use multiple notice and consent records for different elements of a service so a concatenated purpose field will be less useful. My recommendation is to retain the Purpose field in a more general string format for people to use as they wish.

Regards

Joss

Kantara Consent Receipt specification: http://kantarainitiative.org/confluence/download/attachments/76447870/DRAFT%20Recommendation%20Consent%20Receipt%20Specification%201_0_0.docx?version=1&modificationDate=1490575298000&api=v2

Joss Langford

Activinsights | Technical Director

+44 (0)1392 247131 | +44 (0) 7712 886208

www.activinsights.com | www.geneactiv.org

Important Information: The contents of this email are intended for the named addresses only and contain information which is confidential and which may also be privileged. Unless you are the named addressee (or authorised to receive for the addressee) you may not copy, use it, or disclose it to anyone else. If you received it in error, please notify us immediately at info@geneactiv.co.uk and then destroy it. Further, whilst we make efforts to keep our network free from computer viruses, etc., you do need to check this email and any attachments to it for viruses as we can take no responsibility for any viruses which might be transferred by way of this email.

Activinsights Limited, 6 Nene Road, Bicton Industrial Park, Kimbolton, Cambs, PE28 0LF, UK. A company registered in England & Wales. Registered number: 6576069

coel message