What is an Informed Consent & Consent Artefact?

Companies want access to more and more of your personal data. The Personal Data Protection Bill 2019 [currently referred to a Joint Parliamentary Committee (JPC) of both the Houses of Parliament] requires entities to take Consent from Data Principals (data owners) to access and further process their data. 

Consent helps both entities – Data Principals are in control of their data and entities get Consent from the Data Principals in an unambiguous way which removes their liability.

Individual consent given becomes the bedrock for data accessing and processing by the business entities. The success of this is linked to the detailing of the consent in the consent framework. The current practice adopted by the businesses is such that the consent is often taken in a surreptitious manner with little or no flexibility in choosing what you want to share. 

The Personal Data Protection Bill (PDP) aims to bring this consent management to the forefront and give the users the opportunity to choose the data they are willing to share, keep a track of all the consents that have been given by them over time.

MeitY (Ministry of Electronics & Information Technology, Government of India) has defined the data structure in which the consent would be stored and it’s called a consent artifact. It defines consent artifact as,

A machine-readable electronic document that specifies the parameters and scope of data share that a user consents to in any data sharing transaction

Electronic Consent Framework, Technology Specifications, Version 1.1 (section 5.1)

The Account Aggregators provide an electronic consent dashboard to the Data Principals where they are able to track their consents. The consent must be free, informed, specific, clear, and revocable.

What is an Uninformed Consent?

Internet users unintentionally allow ads to follow them all around the internet via browser cookies. Smartphones are able to track to your physical location and have been known to track even when we disable location services. The problem here is that we as users have given consent to these businesses in an uninformed way. 

By clicking on the “I accept” button on the websites, we leave our digital footprint across the internet. We did this primarily to avoid reading long legal gibberish about what the entity intends to do with the data in the “Privacy Policy” page. Despite the policy shown is detailed, the verbosity of the text scares us away. This is a classic case of uninformed consent. Businesses have thrived by taking the route of sharing an overload of information.

What is Informed Consent?

Personal data should never be shared without the Data Principal’s consent. The entities not only takes an explicit Consent from the data principal but also declares,

• Entities involved: Declares the FIP and FIU entity names
• The purpose of seeking the data – lending, wealth management, personal finance app, loan monitoring
• Data Life: The period for which the entity can process the data
• Frequency of fetching data: Onetime (e.g. for the purpose of a loan application) or recurring (e.g. for the purpose of loan monitoring, wealth management)
• Data fields: Which data fields are being shared – e.g. bank balance, transaction details of the bank statement
• Consent time validity: The duration in which the consent request is valid. 
• Digital Signature: The Consent Artefact (explained later) is digitally signed by the Account Aggregator. This guarantees the FIPs that the request came from that particular AA.

Uninformed Vs Informed Consent

The example above clearly demonstrates the benefits of seeking informed consent from a Data Principal. The Data Principal clearly understands what they are consenting to and he is now empowered because of informed consent.

ORGANS Framework Enables Informed Consent