A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt document?

However, I kinda doubt this could be used as a evidence in the future should it be required due to the nature of .txt file. Obviously, it can be edited at any time without any trace. Which kind of indicates the records about consent might have been put there manually after the claim has been raised by the user? As if, forging the evidence.

I tried looking into the information provided by the ICO itself, to find how to correctly store this kind of data (not how to collect it, but where to store it) but can't find anything like that.

Perhaps anyone has any clue where does the data need to be stored for it be accepted as an evidence if required?

Thanks a lot!


How to store consent

According to the ICO, you need to store the following:

  • Who consented

    the name of the individual, or other identifier (eg, online user name, session ID).

  • When they consented

    a copy of a dated document, or online records that include a timestamp; or, for oral consent, a note of the time and date which was made at the time of the conversation.

  • What they were told at the time

    A master copy of the document or data capture form containing the consent statement in use at that time, along with any separate privacy policy, including version numbers and dates matching the date consent was given. If consent was given orally, your records should include a copy of the script used at that time.

  • How they consented

    For written consent, a copy of the relevant document or data capture form. If consent was given online, your records should include the data submitted as well as a timestamp to link it to the relevant version of the data capture form. If consent was given orally, you should keep a note of this made at the time of the conversation - it doesn’t need to be a full record of the conversation.

  • Whether they have withdrawn consent

    And if so, when.

Source (p33/34)

Would a txt file of users who had consented be acceptable

The ICO provides this example as unacceptable:

You keep a spreadsheet with ‘consent provided’ against a customer’s name.

Source (p34)

This shows that a TXT file of usernames would not be acceptable, as there is not enough information stored

What would be acceptable

You would want a table that looks something like this

| UserId | Date | PolicyRevision | Method | WithdrawalDate |

How to verify this data has not been modified

You could store a hash of the row on some form of blockchain, to prove that after the stated date the consent had not been modified, this would prevent having to store a copy of the user's ID on the blockchain. It would not prevent forging consent at the time you claim it was given, but short of having the user digitally sign the transaction with some key that you do not have access to, there would be no way to prevent this.

  • Sounds like a lot of fuss, but thanks. Just what I was looking for. Is there a source for the last bit about TXT document? – Oful Jun 3 '18 at 22:19
  • It's in the document I linked, just after what you have to store – jrtapsell Jun 3 '18 at 22:21
  • Cant find it, not sure if tired or what. Anyway, where should I store it if not in .txt document? – Oful Jun 3 '18 at 22:26
  • 2
    Added an explicit source link, you can store it however you want, it is more that you need all of the details, rather than just a user ID, however having some way of proving a record was set at a given time may be very helpful if you need to prove that you did not create it later on, which either using some form of blockchain, or some other way of pinning a version in time will provide – jrtapsell Jun 3 '18 at 22:28
  • 1
    A txt file would be acceptable if it contained all the required information. An example would be a CSV or TSV which are just txt files themselves. However with the required information to track consent the file wouldn’t be easily read. As to a block chain, if the block chain was used only for this purpose like any form of digital data it could still be forged. Thus sort of a mute point. I also don’t recall any portion of the GDPR specifying that there has to be some sort of way of verifying the data specifically. Just that the data needs to be recorded. But that’s a legal matter in itself. – Shinrai Jun 9 '18 at 21:06

The method you use to store the information doesn't matter, as long as it is secure. You can store all the textual information you want in a txt file (for example in tab-separated fields), but why not use a database management system to manage this data? For example storing it in a MYSQL database table, which can then be queried and modified much more easily.

As for the "evidence" that a user has actually given consent, I'm afraid it is not possible to really prove it, unless you use specific technologies like blockchains or digital signatures. But does anybody know if blockchain technology compliant with GDPR? Or can we expect every user to own a private key and digitally sign every decision they make? No one is going to do this for now, it would be too difficult to implement and enforce. I believe this part of the law is faulty and can't reasonably be expected to be taken literally or be enforced. All you can do for now is to record as much information as you can about the consent, so that at least it can help you if you ever had to try and demonstrate that a certain user has given consent.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.