A Smart Contract-Based Dynamic Consent Management System for Personal Data Usage under GDPR

Abstract

A massive amount of sensitive personal data is being collected and used by scientists, businesses, and governments. This has led to unprecedented threats to privacy rights and the security of personal data. There are few solutions that empower individuals to provide systematic consent agreements on distinct personal information and control who can collect, access, and use their data for specific purposes and periods. Individuals should be able to delegate consent rights, access consent-related information, and withdraw their given consent at any time. We propose a smart-contract-based dynamic consent management system, backed by blockchain technology, targeting personal data usage under the general data protection regulation. Our user-centric dynamic consent management system allows users to control their personal data collection and consent to its usage throughout the data lifecycle. Transaction history and logs are recorded in a blockchain that provides trusted tamper-proof data provenance, accountability, and traceability. A prototype of our system was designed and implemented to demonstrate its feasibility. The acceptability and reliability of the system were assessed by experimental testing and validation processes. We also analyzed the security and privacy of the system and evaluated its performance.

Data Protection by Design Tool for Automated GDPR Compliance Verification Based on Semantically Modeled Informed Consent

“…Semantics and blockchain are also used by Merlec et al [ 7 ], who present a dynamic consent management system for personal data usage in compliance with GDPR. The system supports functionalities such as data provisioning, user management, and authentication.…”

“…The system supports functionalities such as data provisioning, user management, and authentication. Some of the known limitations, as mentioned by the authors in [ 7 ], include the complexity of the presented solution, immutability of blockchain, and the automation of security and privacy policies verification and GDPR compliance checking, which is planned as future work.…”

“…However, these requirements have also posed significant challenges to companies regarding the automation of compliance verification. Several software tools for GDPR compliance have already been developed that cover some steps required for automated compliance verification (e.g., [ 3 , 4 , 5 , 6 , 7 ]). In most cases, these tools address only a specific subset of the GDPR regulations, such as audit (or auditability) [ 8 ] or only consent management.…”

A Consortium Blockchain-Based Secure and Trusted Electronic Portfolio Management Scheme

“…It comprises the following modules: (a) The security manager provides user credentials and e-portfolio data security-related features such as authentication, authorization, confidentiality, and accountability. (b) The access control manager authorizes or denies access to e-portfolio data depending on the access control policies and rules embedded in the consent agreement contracts [ 47 ]. (c) The privacy manager helps users define and manage their privacy preferences, and (d) the audit manager enables users to audit their e-portfolio history in terms of when it was requested and accessed and by whom for verification.…”

Blockchain-Based Service-Oriented Architecture for Consent Management, Access Control, and Auditing

“…In the healthcare domain, several approaches solve consent management through blockchain, a technology trend in this field [3]. For instance, a general-purpose blockchain platform that adopts an ontology-based consent model has been developed for managing data subject consents [4]. In [5], Rantos et al present a blockchain platform that facilitates data controller interaction with the data subject under GDPR.…”