Implementing ISO/IEC TS 27560:2023 Consent Records and Receipts for GDPR and DGA-Reference-Cited by-同舟云学术

Implementing ISO/IEC TS 27560:2023 Consent Records and Receipts for GDPR and DGA

Published:2024 Issue: Volume: Page:228-251
ISSN:0302-9743
Container-title:Lecture Notes in Computer Science
language:en
Short-container-title:

Author:

Pandit Harshvardhan J.^ORCID,Lindquist Jan,Krog Georg P.

Abstract

AbstractThe ISO/IEC TS 27560:2023 Privacy technologies—Consent record information structure provides guidance for the creation and maintenance of records regarding consent as machine-readable information. It also provides guidance on the use of this information to exchange such records between entities in the form of ‘receipts’. In this article, we compare requirements regarding consent between ISO/IEC TS 27560:2023, ISO/IEC 29184:2020 Privacy Notices, and the EU’s General Data Protection Regulation (GDPR) to show how these standards can be used to support GDPR compliance. We then use the Data Privacy Vocabulary (DPV) to implement ISO/IEC TS 27560:2023 and create interoperable consent records and receipts. We also discuss how this work benefits the implementation of EU Data Governance Act (DGA), specifically for machine-readable consent forms.

Publisher

Springer Nature Switzerland

Link

https://link.springer.com/content/pdf/10.1007/978-3-031-68024-3_12

Reference16 articles.

1. Esteves, B., Pandit, H.J., Rodríguez-Doncel, V.: ODRL profile for expressing consent through granular access control policies in solid. In: 2021 IEEE European Symposium on Security and Privacy Workshops (EuroS PW), pp. 298–306 (2021). https://doi.org/10.1109/EuroSPW54576.2021.00038

2. Esteves, B., Rodríguez-Doncel, V.: Analysis of ontologies and policy languages to represent information flows in GDPR. Semantic Web (Preprint) 1–35 (2022)

3. Iannella, R., Villata, S.: ODRL Information Model 2.2 (2018). https://www.w3.org/TR/odrl-model/

4. ISO/IEC 29100:2011 Information technology—Security techniques—Privacy framework. Technical report, International Standards Organisation (ISO) (2011)

5. ISO/IEC: ISO/IEC 29184:2020 Information technology – Online privacy notices and consent (2020)