Authors:
(1) Harshvardhan J. Pandit, ADAPT Centre, Dublin City University, Dublin, Ireland, and Cybersecurity and Data Protection Group, National Standards Institute, Ireland ([email protected])
(2) Jan Lindquist, Privacy and Security Group, Institute for Standards, Sweden ([email protected]);
(3) Georg P. Krog, Signatu AS, Oslo, Norway ([email protected]).
Table of Links
2 Overview of ISO/IEC TS 27560:2023
3 Comparing ISO-27560, ISO-29184, and GDPR
4 Consent Records and Receipts using DPV
6 Implementation Considerations and Future Work
6.2 Using Records and Receipts with eIDAS and EUDI Wallet
6.5 IEEE P7012 Machine-Readable Privacy Terms
A Example of Consent Record with both required and optional fields
B Example of Consent Receipt with required fields from consent record
B Example of Consent Receipt with required fields from consent record
1 { 2 "@id": "https://example.com/receipt-asdmj1oasd", 3 "@type": "dpv:ConsentRereceipt", 4 "dct:identifier": "receipt-asdmj1oasd", 5 "dct:conformsTo": "https://w3id.org/dpv/schema/dpv-27560#receipt", 6 "dct:created": "2024-01-31",
7 "dct:publisher": "ex:Acme",
8 "schema:recipient": "dpv:DataSubject",
9 "dpv:hasRecordOfActivity": {
10 "@id": ,→ "https://example.com/a6f58318-72e6-46a2-bfd7-f36d795e30cd",
11 "@type": "dpv:ConsentRecord",
12 "dct:identifier": "a6f58318-72e6-46a2-bfd7-f36d795e30cd",
13 "dct:conformsTo": "https://w3id.org/dpv/schema/dpv-27560#record",
14 "dpv:hasDataSubject": {
15 "@id": "0760c9ba",
16 "type": "dpv:Consumer"
17 },
18 "dpv:hasDataController": "ex:Acme",
19 "dpv:hasDataProcessor": "ex:Beta",
20 "dpv:hasJurisdiction": ["loc:IE"],
21 "dpv:hasApplicableLaw": "eu-gdpr:GDPR",
22 "dpv:hasProcess": {
23 "@type": "dpv:Process",
24 "dpv:hasRecipient": ["ex:Acme", "ex:Beta"],
25 "dpv:hasPurpose": "dpv:PaymentManagement",
26 "dpv:hasPersonalData": "pd:EmailAddress",
27 "dpv:hasStorageCondition": [{
28 "@type": "dpv:StorageLocation",
29 "dpv:hasLocation": ["loc:IE", "loc:FR", "loc:DE"]
30 }, {
31 "@type": "dpv:StorageDuration",
32 "dpv:hasDuration": "P6M"
33 }, {
34 "@type": "dpv:StorageDeletion",
35 "dpv:hasDuration": "P1M"
36 }]
37 },
38 "dpv:hasProcess": {
39 "@type": "dpv:Process",
40 "dpv:hasRecipient": ["ex:Acme", "dpv:DataSubject"],
41 "dpv:hasPurpose": "dpv:IdentityVerification",
42 "dpv:hasPersonalData": "pd:OfficialID",
43 "dpv:hasStorageCondition": [{
44 "@type": "dpv:StorageLocation",
45 "dpv:hasLocation": "dpv:WithinDevice"
46 }, {
47 "@type": "dpv:StorageDuration",
48 "dpv:hasDuration": {
49 "@type": "dpv:UntilEventDuration",
50 "rdf:value": "Account Closure"
51 }
52 }]
53 },
54 "dpv:hasInvolvementControl": {
55 "@type": ["dpv:ProvidingPermission",
,→ "dpv:WithdrawingPermission"],
56 "dpv:isExercisedAt": "https://example.com/manage-consent"
57 },
58 "dpv:hasRight": {
59 "@type": ["dpv:DataSubjectRight", "eu-gdpr:A7-3"],
60 "dct:title": "Right to Withdraw Consent",
61 "dpv:isExercisedAt": "https://example.com/rights"
62 },
63 "dpv:hasNotice": {
64 "@id": ,→ "https://example.com/notices/a6f58318-72e6-46a2-bfd7-f36d795e30cd",
65 "@type": "dpv:ConsentNotice",
66 "dct:date": "2024-01-01",
67 "dct:language": "EN",
68 "dct:coverage": "2024-01-01/P12M"
69 },
70 "dpv:hasConsentStatus": [{
71 "@type": ["dpv:ConsentGiven", "dpv:ExpressedConsent"],
72 "dpv:isIndicatedBy": "dpv:DataSubject",
73 "dpv:hasIndicationMethod": "Interaction in App",
74 "dpv:isIndicatedAtTime": "2024-01-01"
75 }, {
76 "@type": "dpv:ConsentWithdrawn",
77 "dpv:isIndicatedBy": "dpv:DataSubject",
78 "dpv:hasIndicationMethod": "Interaction in App",
79 "dpv:isIndicatedAtTime": "2024-04-20"
80 }]
81 }
82 }
This paper is available on arxiv under CC BY 4.0 DEED license.
