How to store consent
According to the ICO, you need to store the following:
the name of the individual, or other identifier (eg,
online user name, session ID).
When they consented
a copy of a dated document, or online
records that include a timestamp; or, for oral consent, a note of the
time and date which was made at the time of the conversation.
What they were told at the time
A master copy of the document
or data capture form containing the consent statement in use at
numbers and dates matching the date consent was given. If consent
was given orally, your records should include a copy of the script
used at that time.
How they consented
For written consent, a copy of the relevant
document or data capture form. If consent was given online, your
records should include the data submitted as well as a timestamp to
link it to the relevant version of the data capture form. If consent
was given orally, you should keep a note of this made at the time of
the conversation - it doesn’t need to be a full record of the
Whether they have withdrawn consent
And if so, when.
Would a txt file of users who had consented be acceptable
The ICO provides this example as unacceptable:
You keep a spreadsheet with ‘consent provided’ against a
This shows that a TXT file of usernames would not be acceptable, as there is not enough information stored
What would be acceptable
You would want a table that looks something like this
| UserId | Date | PolicyRevision | Method | WithdrawalDate |
How to verify this data has not been modified
You could store a hash of the row on some form of blockchain, to prove that after the stated date the consent had not been modified, this would prevent having to store a copy of the user's ID on the blockchain. It would not prevent forging consent at the time you claim it was given, but short of having the user digitally sign the transaction with some key that you do not have access to, there would be no way to prevent this.