Key Decision Log (Consent)

This document outlines key decisions made on the Consent Building Block project, so that new contributors can understand the context and history.

November-2021	Decided to scope and work on basic flows first with Consent BB version 1.0. This will scope out some items as described in chapter Out-of-scope and future enhancements
January-2022	Removed “consenter” and “consentee” terminology: Due to the ambiguity of what these two terms mean, we strictly mention only “individual”, “data processor” and “data controller”.
March-2022	The lifecycle of a single Agreement should match a single purpose. A Consent Record can only match 1 Agreement.
March-2022	Data structures, API URL call structures etc., should never reveal personally identifiable information (PII). We assume that anonymised IDs and tokens can handle relations to identity.
March-2022	Right To Be Forgotten: The scope of this action is decided to be framed by each Agreement. The building block definition covers a variety of different use cases deleted to remove traces or needs to be retained is not by design necessary for the Consent BB to decide.
March-2022	Revision+Signature models are designed to give a tamper-resistant, auditable track of all schemas. Auditability means: 1) Event-based external tracking that may verify that the system’s data isn’t tampered with and 2) Revision and Signature logs that can be queried to periodically verify that specific event (such as data transactions) is happening in accordance with valid Consent Records and Agreements.