Difference between revisions of "Consent"
From MgmtWiki
(→The Process) |
(→The Consent Record) |
||
| (36 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
==Full Title or Meme== | ==Full Title or Meme== | ||
[[Consent]] is a process that the [[User]] undertakes at a [[Web Site]] to agree to some conditions of use of that site. Only some [[Artifact]] of the process can be used as proof that consent was freely given. | [[Consent]] is a process that the [[User]] undertakes at a [[Web Site]] to agree to some conditions of use of that site. Only some [[Artifact]] of the process can be used as proof that consent was freely given. | ||
| + | |||
| + | ==Principles== | ||
| + | The opposite of willing consent is abuse. | ||
| + | <blockquote>"I May Destroy You." created by he British-Ghanaian writer and actor Michaela Coel has been described as a drama about consent, but mostly it's a show about trauma - how mutable and contagious it is, how insidious and pervasive. The story doesn't build so much as it burrows, digging into crevices to reveal an infinite regress of damage. With each new trauma its characters endure, another is set off, or uncovered, or recalled, revealing a system of abuse so ubiquitous, so normalized as to be invisible, hiding in plain sight.<ref>Editorial ''At Risk'' NY Times Magazine 2020-08-02 p 7 ff</ref></blockquote> | ||
| + | That show is about sexual and physical abuse, but the quote applies directly to the lack of consent that web users experience every day they pick up their smartphone. | ||
| + | #The only sin is for one human to use another human without their informed and willing consent. | ||
| + | #The only cowardice is for any human to allow one human to use another human without their informed and willing consent. | ||
==Context== | ==Context== | ||
| − | + | *Prior to 2019 consent of users to actions in cyberspace has been found in a [[Privacy Policy]] or [[Terms of Service]] which in many countries take on legal weight as a [[Contract of Adhesion]]. That legal basis is now being re-imagined in many legal jurisdictions. | |
| + | * Definitions: Compliance or approval, especially to what is done or proposed by another.<ref>Webseter's Third New International Dictionary</ref> | ||
| + | *Components <ref>Nancy S. Kim, ''Consentability: Consent and its Limits.'' (2019-04-04) ISBN 978-1316616550</ref> | ||
| + | # Act of consent by the person (By 2020 it must be explicit, rather than implicit or buried in some other document.) | ||
| + | # Knowledge or Understanding of what is requested and what the impact might result (also called transparency in some documents) | ||
| + | # Voluntary or Freedom to chose | ||
==Problems== | ==Problems== | ||
| − | It's easy to say that the user should have control of their own data, it's hard to capture the fact. | + | * An individual is nearly powerless against a large organization, beit a feudal barony or a large corporation. Since baronies and corporations where given the patina of legality, they have abused individual humans for all of recorded history. |
| + | * Individuality as imagined by Hobbes and Luther has turned into a mind-alering drug that provide the illusion of freedeom with none of the benefits. | ||
| + | *It's easy to say that the user should have control of their own data, it's hard to capture the fact. Facebook and Google refuse to provide their service if you don't given the consent to store your entire life online. That is not really a choice for most people that use the internet daily. | ||
| + | *"Consent, in its purest form, could easily become a dystopian stick to control citizens with," Susan Morrow, doesn't pull her punches as she argues that GDPR hasn't resolved the conflict between choice and consent. <ref>Susan Morrow, ''50 shades of privacy: Consent and the fallacy that will prevent privacy for all.'' (2019-05) Information Age https://www.information-age.com/consent-privacy-gdpr-privacy-by-design-default-123482351/</ref> | ||
==Solutions== | ==Solutions== | ||
===The Process=== | ===The Process=== | ||
In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. | In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. | ||
| − | |||
The Office of the Privacy Commissioner of Canada has published Guidelines for obtaining meaningful consent<ref>Privacy Commissioner of Canada, ''Guidelines for obtaining meaningful consent.'' https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_omc_201805/</ref> which "sets out practical and actionable guidance regarding what organizations should do to ensure that they obtain meaningful consent." | The Office of the Privacy Commissioner of Canada has published Guidelines for obtaining meaningful consent<ref>Privacy Commissioner of Canada, ''Guidelines for obtaining meaningful consent.'' https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_omc_201805/</ref> which "sets out practical and actionable guidance regarding what organizations should do to ensure that they obtain meaningful consent." | ||
| Line 18: | Line 32: | ||
* One source for a Consent artifact is the Indian Government<ref>Ministry of Electronics & Information Technology, ''Electronic Consent Framework Technology Specifications, Version 1.1'' Government of India (undated, retrieved on 2019-04-09) http://dla.gov.in/sites/default/files/pdf/MeitY-Consent-Tech-Framework%20v1.1.pdf</ref> this document has the XML format of a consent artifact. Note: crore = ten million; one hundred lakhs, especially of rupees, units of measurement, or people. | * One source for a Consent artifact is the Indian Government<ref>Ministry of Electronics & Information Technology, ''Electronic Consent Framework Technology Specifications, Version 1.1'' Government of India (undated, retrieved on 2019-04-09) http://dla.gov.in/sites/default/files/pdf/MeitY-Consent-Tech-Framework%20v1.1.pdf</ref> this document has the XML format of a consent artifact. Note: crore = ten million; one hundred lakhs, especially of rupees, units of measurement, or people. | ||
| + | * The wiki page [[Consent Receipt]] describes an artifact that is created by the recipient of the [[User Information]]. The version 1.0 does not prove that consent was freely given. | ||
| + | |||
| + | ===The Taxonomy=== | ||
| + | The question inevitably arises, "What is it that the User has agreed to Share?" This question implies that there is a taxonomy of shareable attributes that is equally understandable to (1) the user, (2) the data controller and (3) the regulatory agency that determines whether consent was actually given. | ||
| + | * [https://www.w3.org/ns/dpv Data Privacy Vocabulary v0.1] seeks to provide such a taxonomy and even mentions consent, but the shear volume of taxa basically is too large to expect that users could possible understand the details even if they wanted to. | ||
| + | ===HIPPA=== | ||
| + | What is the difference between “consent” and “authorization” under the HIPAA Privacy Rule?<ref>US Dept of Health and Humans Services https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html</ref> | ||
| + | |||
| + | The Privacy Rule permits, but does not require, a covered entity voluntarily to obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations. Covered entities that do so have complete discretion to design a process that best suits their needs. | ||
| + | |||
| + | By contrast, an “authorization” is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual. | ||
| + | |||
| + | An authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization. | ||
| − | == | + | ===The ISO Standard=== |
| + | [https://standardsdevelopment.bsigroup.com/projects/9020-03691#/section ISO/IEC JTC 1/SC 27 N 20243, Reserved 27560 Privacy technologies - Consent record information structure] for recording PII Principals' (data subjects') consent to process their personal data. | ||
| + | ===The Consent Record=== | ||
| + | The Consent Record described in ISO 27560 is a data structure that can be encoded as a verifiable credential. | ||
| + | ===Data Rights Protocol=== | ||
| + | * [https://github.com/consumer-reports-innovation-lab/data-rights-protocol On GitHub] | ||
| + | ==References== | ||
| + | <references /> | ||
| + | ===External Sources=== | ||
| + | * [https://docs.google.com/document/d/1wCpFqF0h7MD5xZFMcKOx2p28GEbMANpXOOXZ6_1XNS8/edit#heading=h.x6qv37ebsqvr Cardea on Consent] 2022-08-11 | ||
| + | * [https://cloud.google.com/healthcare/docs/concepts/consent Google Healthcare API - Consent and privacy overview] | ||
| + | *[http://hl7.org/fhir/R4/consent.html R4 of FHIR Resource consent]. 'A record of a healthcare consumer’s choices, which permits or denies identified recipient(s) or recipient role(s) to perform one or more actions within a given policy context, for specific purposes and periods of time.' | ||
| + | *[https://www.hl7.org/fhir/consent-examples.html FHIR Consent Fields] could be helpful in creating consents. | ||
| + | * [[Web Authentication]] defines '''User Consent''' as when the user agrees with what they are being asked, i.e., it encompasses reading and understanding prompts. An authorization gesture is a [[Ceremony]] component often employed to indicate user consent. | ||
[[Category:Glossary]] | [[Category:Glossary]] | ||
[[Category:Privacy]] | [[Category:Privacy]] | ||
[[Category:Consent]] | [[Category:Consent]] | ||
Latest revision as of 15:45, 8 August 2023
Contents
Full Title or Meme
Consent is a process that the User undertakes at a Web Site to agree to some conditions of use of that site. Only some Artifact of the process can be used as proof that consent was freely given.
Principles
The opposite of willing consent is abuse.
"I May Destroy You." created by he British-Ghanaian writer and actor Michaela Coel has been described as a drama about consent, but mostly it's a show about trauma - how mutable and contagious it is, how insidious and pervasive. The story doesn't build so much as it burrows, digging into crevices to reveal an infinite regress of damage. With each new trauma its characters endure, another is set off, or uncovered, or recalled, revealing a system of abuse so ubiquitous, so normalized as to be invisible, hiding in plain sight.[1]
That show is about sexual and physical abuse, but the quote applies directly to the lack of consent that web users experience every day they pick up their smartphone.
- The only sin is for one human to use another human without their informed and willing consent.
- The only cowardice is for any human to allow one human to use another human without their informed and willing consent.
Context
- Prior to 2019 consent of users to actions in cyberspace has been found in a Privacy Policy or Terms of Service which in many countries take on legal weight as a Contract of Adhesion. That legal basis is now being re-imagined in many legal jurisdictions.
- Definitions: Compliance or approval, especially to what is done or proposed by another.[2]
- Components [3]
- Act of consent by the person (By 2020 it must be explicit, rather than implicit or buried in some other document.)
- Knowledge or Understanding of what is requested and what the impact might result (also called transparency in some documents)
- Voluntary or Freedom to chose
Problems
- An individual is nearly powerless against a large organization, beit a feudal barony or a large corporation. Since baronies and corporations where given the patina of legality, they have abused individual humans for all of recorded history.
- Individuality as imagined by Hobbes and Luther has turned into a mind-alering drug that provide the illusion of freedeom with none of the benefits.
- It's easy to say that the user should have control of their own data, it's hard to capture the fact. Facebook and Google refuse to provide their service if you don't given the consent to store your entire life online. That is not really a choice for most people that use the internet daily.
- "Consent, in its purest form, could easily become a dystopian stick to control citizens with," Susan Morrow, doesn't pull her punches as she argues that GDPR hasn't resolved the conflict between choice and consent. [4]
Solutions
The Process
In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.
The Office of the Privacy Commissioner of Canada has published Guidelines for obtaining meaningful consent[5] which "sets out practical and actionable guidance regarding what organizations should do to ensure that they obtain meaningful consent."
The Artifact
- One source for a Consent artifact is the Indian Government[6] this document has the XML format of a consent artifact. Note: crore = ten million; one hundred lakhs, especially of rupees, units of measurement, or people.
- The wiki page Consent Receipt describes an artifact that is created by the recipient of the User Information. The version 1.0 does not prove that consent was freely given.
The Taxonomy
The question inevitably arises, "What is it that the User has agreed to Share?" This question implies that there is a taxonomy of shareable attributes that is equally understandable to (1) the user, (2) the data controller and (3) the regulatory agency that determines whether consent was actually given.
- Data Privacy Vocabulary v0.1 seeks to provide such a taxonomy and even mentions consent, but the shear volume of taxa basically is too large to expect that users could possible understand the details even if they wanted to.
HIPPA
What is the difference between “consent” and “authorization” under the HIPAA Privacy Rule?[7]
The Privacy Rule permits, but does not require, a covered entity voluntarily to obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations. Covered entities that do so have complete discretion to design a process that best suits their needs.
By contrast, an “authorization” is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual.
An authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization.
The ISO Standard
ISO/IEC JTC 1/SC 27 N 20243, Reserved 27560 Privacy technologies - Consent record information structure for recording PII Principals' (data subjects') consent to process their personal data.
The Consent Record
The Consent Record described in ISO 27560 is a data structure that can be encoded as a verifiable credential.
Data Rights Protocol
References
- ↑ Editorial At Risk NY Times Magazine 2020-08-02 p 7 ff
- ↑ Webseter's Third New International Dictionary
- ↑ Nancy S. Kim, Consentability: Consent and its Limits. (2019-04-04) ISBN 978-1316616550
- ↑ Susan Morrow, 50 shades of privacy: Consent and the fallacy that will prevent privacy for all. (2019-05) Information Age https://www.information-age.com/consent-privacy-gdpr-privacy-by-design-default-123482351/
- ↑ Privacy Commissioner of Canada, Guidelines for obtaining meaningful consent. https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_omc_201805/
- ↑ Ministry of Electronics & Information Technology, Electronic Consent Framework Technology Specifications, Version 1.1 Government of India (undated, retrieved on 2019-04-09) http://dla.gov.in/sites/default/files/pdf/MeitY-Consent-Tech-Framework%20v1.1.pdf
- ↑ US Dept of Health and Humans Services https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html
External Sources
- Cardea on Consent 2022-08-11
- Google Healthcare API - Consent and privacy overview
- R4 of FHIR Resource consent. 'A record of a healthcare consumer’s choices, which permits or denies identified recipient(s) or recipient role(s) to perform one or more actions within a given policy context, for specific purposes and periods of time.'
- FHIR Consent Fields could be helpful in creating consents.
- Web Authentication defines User Consent as when the user agrees with what they are being asked, i.e., it encompasses reading and understanding prompts. An authorization gesture is a Ceremony component often employed to indicate user consent.
