GDPR. Where to store users consent?

Question

A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt document?

However, I kinda doubt this could be used as a evidence in the future should it be required due to the nature of .txt file. Obviously, it can be edited at any time without any trace. Which kind of indicates the records about consent might have been put there manually after the claim has been raised by the user? As if, forging the evidence.

I tried looking into the information provided by the ICO itself, to find how to correctly store this kind of data (not how to collect it, but where to store it) but can't find anything like that.

Perhaps anyone has any clue where does the data need to be stored for it be accepted as an evidence if required?

Thanks a lot!

Answer 1

How to store consent

According to the ICO, you need to store the following:

• Who consented

  the name of the individual, or other identifier (eg, online user name, session ID).

• When they consented

  a copy of a dated document, or online records that include a timestamp; or, for oral consent, a note of the time and date which was made at the time of the conversation.

• What they were told at the time

  A master copy of the document or data capture form containing the consent statement in use at that time, along with any separate privacy policy, including version numbers and dates matching the date consent was given. If consent was given orally, your records should include a copy of the script used at that time.

• How they consented

  For written consent, a copy of the relevant document or data capture form. If consent was given online, your records should include the data submitted as well as a timestamp to link it to the relevant version of the data capture form. If consent was given orally, you should keep a note of this made at the time of the conversation - it doesn’t need to be a full record of the conversation.

• Whether they have withdrawn consent

  And if so, when.

Source (p33/34)

Would a txt file of users who had consented be acceptable

The ICO provides this example as unacceptable:

You keep a spreadsheet with ‘consent provided’ against a customer’s name.

Source (p34)

This shows that a TXT file of usernames would not be acceptable, as there is not enough information stored

What would be acceptable

You would want a table that looks something like this

| UserId | Date | PolicyRevision | Method | WithdrawalDate |

How to verify this data has not been modified

You could store a hash of the row on some form of blockchain, to prove that after the stated date the consent had not been modified, this would prevent having to store a copy of the user's ID on the blockchain. It would not prevent forging consent at the time you claim it was given, but short of having the user digitally sign the transaction with some key that you do not have access to, there would be no way to prevent this.

Answer 2

The method you use to store the information doesn't matter, as long as it is secure. You can store all the textual information you want in a txt file (for example in tab-separated fields), but why not use a database management system to manage this data? For example storing it in a MYSQL database table, which can then be queried and modified much more easily.

As for the "evidence" that a user has actually given consent, I'm afraid it is not possible to really prove it, unless you use specific technologies like blockchains or digital signatures. But does anybody know if blockchain technology compliant with GDPR? Or can we expect every user to own a private key and digitally sign every decision they make? No one is going to do this for now, it would be too difficult to implement and enforce. I believe this part of the law is faulty and can't reasonably be expected to be taken literally or be enforced. All you can do for now is to record as much information as you can about the consent, so that at least it can help you if you ever had to try and demonstrate that a certain user has given consent.