10 Apr 2018
This month saw Consentua Creators, KnowNow Information, join the Kantara Initiative.
For over a year now the team at Consentua have been active participants in the evolution of the Consent Receipt specification. As an early adopter of the specification, our team admired the work that Kantara perform in the wider identity and privacy space.
Why should I care about consent receipts?
We should care about consent receipts because they are a very important foundation for a new discipline called Consent Management. This is new to the world of digital technology, as it consists of a mix of marketing, compliance, data lifecycle management, and business operations.
Where consent is the legal basis for processing personal data, being transparent and giving people appropriate controls is essential to complying with the law. The use of consent receipts, building trust with the customer, are an integral part of providing that transparency and control.
Consent receipts give the owner clear notice as to what a user has agreed that their personal data may be used for. Once consent has been established, the consent receipt provides a representation of the data subject’s intent that can be stored, shared and queried.
The clarity and control provided by consent receipts opens up possibilities for awesome new digital services that make use of personal data, but at the same time respect the wishes and autonomy of data subjects.
Interoperability
Enabling and accelerating the interchange of personal data to realise new value requires barriers to be dismantled. Embracing interoperability - of the kind that consent receipts provide - will prevent barriers being erected and help stop rejection of third-party receipts because they ‘were not made here’.
An early co-leadership responsibility that Consentua will therefore take, along with Digi.me, is developing interoperability of the consent receipt specification.
In the age of data portability and with customers demanding seamless machine driven exchanges of data, having an interoperable consent receipt will aid the user experience and increase the likelihood of industry-wide adoption.
Colin Wallis, executive director of the Kantara Initiative stated:
Consentua has always been part of the Kantara family. It’s just that it finally got round to making it formal. And for that, we are very happy!
Kantara Initiative
The Consentua team is looking forward to working even more closely with the Kantara community to help evolve and collaborate on the foundation of consent management, the Consent Receipt!
16 Jan 2018
TL;DR - make more money by improving trust between you and your customers
People ask me “why does anyone need consent management? Aren’t there other, more applicable legal bases for the processing of personal data?”
In many cases this is true. Consent should often be used as the basis of last resort. However, when no other legal basis is available; there is no legitimate interest or regulatory need for data processing, for example; consent is often the best way forward.
Consent is still required
The experience of working with large enterprise, government and even smaller organisations such as schools is that consent is still required in numerous circumstances - even where the organisation is specifically referred to within the GDPR.
One example would be schools. The activities required for education of their pupils are not applicable to GDPR. Schools do, however, carry out many activities that are considered non-essential for the delivery of education to their students.
This will include use of the student photo for marketing purposes, permission to attend a school trip, permission to take part in extra-curricular sports and many more. Some of the education establishments our associates have worked with have, through their Privacy Impact Assessment, identified dozens of cases where consent may be the best legal basis.
Similarly, commercial organisations are often able to rely on a contractual basis for the use and retention of personal information. Sometimes however, this data is required for purposes that extend beyond the strict definitions within the contract and, again, consent is often identified as the appropriate basis.
So what does consent management software actually do?
Consent management increases trust by providing choice and control.
A consent management tool enables an organisation to record the consent interactions that they have with their customers, employees and users. It allows those customers, employees and users to choose what they consent to, what purposes they accept and to control access to their personal data.
We all see consent slips on the bottom of contracts, at the t’s and c’s page of a website or even on the request slip for a child to attend trips with their school. There are some occasions where these consent requests are inappropriate. If you don’t have any real choice about whether you should consent, for example, then consent should not be used as the legal basis for data processing.
Consent receipts and interoperability
Once the consent requests and, crucially, the purposes for the requests have been defined by the organisation, the customer can make an informed decision whether to grant consent. Ideally, that consent is then recorded and a consent receipt is issued that is interoperable with other consent systems.
The record of consent is then able to be queried whenever that personal information is used. This means that the customer experience is improved and trust is created between the organisation and the customer.
It is this increase in trust that is the key benefit of GDPR. There is evidence that a lack of trust in use of personal data severely affects revenues and/or service levels. Maintaining or even improving this trust should have a positive effect on organisations.
How can I prepare?
Your organisation will likely conduct a privacy impact assessment (PIA). This can be completed in conjunction with your data protection officer, or by using a consultant data privacy expert. It enables you to identify the personal information requirements and the appropriate legal basis for recording or processing that information.
If consent is one of the bases you will use then the PIA should identify the consent requests you will need to make. You need to clearly define your data types & ensure that the purposes are clearly defined. This is your consent request.
Together, the consent requests and the purposes for making the requests are pre-requisites for a successful adoption of consent management software. You may also want to think about where in your customer’s interactions you will be asking for consent. Will you need to integrate with other 3rd party software?
For example, if you use a CRM system to manage your customer data, do you need that system to query whether you can record certain information about your customer? Do you need to consult the consent record before sending out marketing material?
Don’t forget you are creating a new a dataset. Consent management is part and parcel of your overall data lifecycle management.
Our own tool is called Consentua. It is available now and ready to be deployed for your organisation today.
Send me an email at [email protected] if you want to see how Consentua can help you to improve trust with your customers.
