Difference between revisions of "Consent Management"
(→Context) |
(→Context) |
||
| Line 5: | Line 5: | ||
The primary consideration is the collection of consent from the user, also the need for [[Recovery]], [[Redress]] and simple maintenance by the user must be addressed as well. | The primary consideration is the collection of consent from the user, also the need for [[Recovery]], [[Redress]] and simple maintenance by the user must be addressed as well. | ||
| − | The EU has already addressed the collection of consent in some guidance.<ref>EU Commission, ''How should my consent be requested?'' https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/how-my-personal-data-protected/how-should-my-consent-be-requested_en</ref> | + | The EU has already addressed the collection of consent in some guidance.<ref>EU Commission, ''How should my consent be requested?'' https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/how-my-personal-data-protected/how-should-my-consent-be-requested_en</ref> The following is a quote from paragraph 42. |
| + | |||
| + | Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. In accordance with Council Directive 93/13/EEC1 a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. | ||
==Problems== | ==Problems== | ||
Revision as of 14:15, 22 July 2018
Full Title or Meme
The process of acquiring, refreshing, managing and deleting user consent to access their personal information and other resources.
Context
The primary consideration is the collection of consent from the user, also the need for Recovery, Redress and simple maintenance by the user must be addressed as well.
The EU has already addressed the collection of consent in some guidance.[1] The following is a quote from paragraph 42.
Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. In accordance with Council Directive 93/13/EEC1 a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.
Problems
Solutions
References
- ↑ EU Commission, How should my consent be requested? https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/how-my-personal-data-protected/how-should-my-consent-be-requested_en
