Adding Permission, Consent, Opt-in, Opt-out

Hi.
Currently we have no way to specify "permission" of the data subject 
without the legal basis being consent - as required by the PSD3 use-case 
below.

---

https://edps.europa.eu/press-publications/press-news/press-releases/2023/financial-and-payment-services-use-personal-data-should-remain-proportionate-and-fair_en

"The EDPS welcomes the efforts made to ensure the Proposals’ consistency 
with the General Data Protection Regulation (GDPR).  Both Proposals 
should specify that the granting of ‘permissions’ to access financial 
data does not equate to giving consent under the GDPR. Likewise, all 
processing of personal data following a request to access an 
individual’s financial data must have an appropriate legal basis under 
the GDPR."

---

My proposal is as follows:


- `Consent`: is already a legal basis, and is the individual's 
permission (based on validity criteria e.g. information in notice)
- `Permission`: will be added as a legal basis (exact term TBD), and is 
an affirmative action in order to initiate or continue a process; this 
makes consent a type of permission with specific additional requirements

- `ObtainPermission`: an organisational measure that asks for permission 
in order to start or continue a process
- `AddressObjection`: an organisational measure that addresses an 
objection before starting or while continuing a process

- `ProvideOptIn`: an organisational measure that provides the ability to 
someone else to initiate the process i.e. to opt into the process
- `ProvideOptOut`: an organisational measure that provides the ability 
to someone else to stop the process i.e. to opt out of the process

---

Confusion questions:

1) Permission (legal basis) vs Obtaining Permission (TOMs) - a legal 
basis is a process providing a justification for enabling something 
which is regulated or required by law, and where the law determines 
where it can be used and its validity. An Organisational Measure is 
determined by the Organisation in terms of how and where it is used. 
Therefore, if the permission is legally required, then it is a legal 
basis, and if it is the organisation's decision - then it is a TOMs. We 
have to use different terms - i.e. "Obtaining Permission" for one of 
these (I chose TOMs) - to distinguish the concepts.

2) Permission vs Consent: Permission can be by the data subject or 
another entity, and can be for personal data or non-personal data. 
Permission for personal data does not necessarily mean consent e.g. in 
the above statement by EDPS, it is clearly stated thus. Consent is a 
type of Permission however - "prior permission" to be more specific. But 
we should not get into the pedantic modelling of this within DPV. What 
matters is that users can issue permissions without it being 'consent' 
(under GDPR).

3) Obtaining Permission vs Providing Opt-in: These two reflect two 
different perspectives with the same end result of the (e.g.) user 
deciding when to start a process. Permission is asking the user if they 
want to permit. Opt-in is giving the ability for the user to decide - 
whenever they want to - whether they want to start a process. A checkbox 
or dialog asking if it is okay to do something is obtaining a permission 
rather than an opt-in. A dialog or checkbox asking if you would like to 
use the beta version is an opt-in rather than a permission. So the 
phrasing and intent matters in choosing the correct term.

These concepts have obvious overlaps, but my intent here is to point out 
that if defined in the manner above - they have their distinctions and 
uses from being distinguished. Their common use has led to confusion 
about their usage, which is definitely not helped with idiotic uses such 
as "opt-in consent" or its evil counterpart - "opt-out consent". For 
DPV, these concepts should be defined precisely as their legal meaning 
rather than the technical haphazard interpretations. In the end, no 
harms will come to pass if someone uses "Obtaining Permission" instead 
of "Providing Opt-in", but having the ability to accurately represent 
the term of choice would certainly help.

---

NOTE1: No DPVCG meeting this THU SEP-07. Next meeting is on THU SEP-14.
NOTE2: There are two major proposals which will be implemented on 
SEP-30. Please see 
https://lists.w3.org/Archives/Public/public-dpvcg/2023Aug/0015.html

Regards,
-- 
---
Harshvardhan J. Pandit, Ph.D
Assistant Professor
ADAPT Centre, Dublin City University
https://harshp.com/

Received on Monday, 4 September 2023 17:41:57 UTC