R O T E C T I O N R E G U L AT I O N S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 2 ✦ data protection regulation for all individuals within European Union ✦ since 25 May 2018 ‣ Organizations processing personal data must comply with GDPR! ‣ Protection: Protect personal data Goals ‣ Control: Give data subjects control over personal data personal data: any information relating to an identifiable natural person (‘data subject’)
GDPR Article 6 - Lawfulness of processing Processing shall be lawful […] if data subject has given consent to the processing of his personal data for one or more specific purposes Contract purpose: the reason for which personal data is processed (e.g. marketing, treatment etc.) Legal obligation Vital Interest Public Interest Legitimate Interest S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 3
V O C AT I O N U N D E R G D P R ”any freely given, specific, informed and unambiguous […] clear affirmative action” by a data subject agrees to the processing of his / her personal data GDPR Article 4 §11 - Definitions S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 4 Valid Consent
V O C AT I O N U N D E R G D P R ”any freely given, specific, informed and unambiguous […] clear affirmative action” by a data subject agrees to the processing of his / her personal data GDPR Article 4 §11 - Definitions GDPR Article 7 § 3 - Conditions for consent The data subject have right to withdraw his / her consent at any time S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 4 Valid Consent Revocation
Design via Workflows Research Problem Summary § Outlook Approach Foundation S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 5
might help! M O T I VAT I O N : P R I VA C Y B Y D E S I G N A Workflow includes a series of tasks to achieve a goal ‣ also how tasks are performed, in what order, and by whom S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 6
R I VA C Y B Y D E S I G N V I A W O R K F L O W S Da a S e Da a Objec Te A a P La e Ta S a E e E d E e E c e Ga e a I c e Ga e a Pa a e Ga e a Se e ce F Me a e F Da a A c a A c a BPMN Core Elements S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 7
O B L E M privacy-aware? How to handle revocation? How to handle consent? handles consent & revocation? S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 8
O B L E M privacy-aware? How to handle revocation? How to handle consent? handles consent & revocation? Approach: Design Patterns S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 8
Summary § Outlook Approach Foundation Data-Aware Workflow Consent Policy Consent Form S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 9
Which purposes require consent to be lawful 2- Consent Policy Which data attributes are (potentially) used for which purpose in the Workflow F O U N D AT I O N Which information should be given to data subject for a valid consent 3- Consent Form S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 10
Te A a P La e Ta S a E e E d E e E c e Ga e a I c e Ga e a Pa a e Ga e a Se e ce F Me a e F Da a A c a A c a Workflow S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 11
Da a Objec Te A a P La e Ta S a E e E d E e E c e Ga e a I c e Ga e a Pa a e Ga e a Se e ce F Me a e F Da a A c a A c a Workflow S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 11
Da a Objec Te A a P La e Ta S a E e E d E e E c e Ga e a I c e Ga e a Pa a e Ga e a Se e ce F Me a e F Da a A c a A c a Workflow * Different types of Data Handling in BPMN are stated in [1] [1] Besik, Saliha Irem, and Johann-Christoph Freytag. "Ontology-Based Privacy Compliance Checking for Clinical Workflows." Data Annotation S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 11
I C Y • the modality of data processing, obligatory or voluntary (requires consent) S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 12
data is accessed; •requiresConsent ∈ {true, false} C O N S E N T P O L I C Y • the modality of data processing, obligatory or voluntary (requires consent) S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 12
data is accessed; •requiresConsent ∈ {true, false} P1: An explicit consent is required for newborn hearing screening. Example: C O N S E N T P O L I C Y • the modality of data processing, obligatory or voluntary (requires consent) S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 12
data is accessed; •requiresConsent ∈ {true, false} P1: An explicit consent is required for newborn hearing screening. Example: C O N S E N T P O L I C Y • the modality of data processing, obligatory or voluntary (requires consent) S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 12
data is accessed; •requiresConsent ∈ {true, false} (newborn-hearing-screening, true) P1: An explicit consent is required for newborn hearing screening. Example: C O N S E N T P O L I C Y • the modality of data processing, obligatory or voluntary (requires consent) S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 12
M Valid consent ”any freely given, specific, informed and unambiguous […] clear affirmative action” S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 13 Data Controller: natural person who determines the purposes and means of the processing Data Controller Purpose
M Valid consent ”any freely given, specific, informed and unambiguous […] clear affirmative action” S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 13 We, as Hospital X, use your personal data for newborn hearing screening. Example: Data Controller: natural person who determines the purposes and means of the processing Data Controller Purpose
M Valid consent ”any freely given, specific, informed and unambiguous […] clear affirmative action” S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 13 We, as Hospital X, use your personal data for newborn hearing screening. Example: Data Controller: natural person who determines the purposes and means of the processing Hospital X newborn hearing screening Data Controller Purpose
M Valid consent When multiple purposes, consent should be given for all! ”any freely given, specific, informed and unambiguous […] clear affirmative action” S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 13 We, as Hospital X, use your personal data for newborn hearing screening. Example: Data Controller: natural person who determines the purposes and means of the processing Hospital X newborn hearing screening Data Controller Purpose Separate / Aggregated Consent Forms
Approach Consent Pattern Summary § Outlook Foundation Examples Revocation Pattern S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 14
A G G R E G AT E D C O N S E N T Policy: purposeB & purposeC require consent S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 17
A G G R E G AT E D C O N S E N T “Potential” Issue: Consent is obtained yet never used Policy: purposeB & purposeC require consent S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 17 when to ask consent?
A G G R E G AT E D C O N S E N T Policy: purposeB & purposeC require consent S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 17 when to ask consent? Strategy: ask it just before data operation to minimize this risk
A G G R E G AT E D C O N S E N T Policy: purposeB & purposeC require consent S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 17
A G G R E G AT E D C O N S E N T Policy: purposeB & purposeC require consent Aggregated Consent Form Consent Form Data Controller Purpose: Data Subject purposeB purposeC S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 17
S E PA R AT E C O N S E N T Policy: pA & pB require consent S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 18 Aggregated vs Separate Consent Form?
S E PA R AT E C O N S E N T Policy: pA & pB require consent S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 18 Aggregated vs Separate Consent Form? “Potential” Issue: Consent is obtained yet never used
S E PA R AT E C O N S E N T Policy: pA & pB require consent S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 18 Consent Form Purpose pA
S E PA R AT E C O N S E N T Policy: pA & pB require consent S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 18 Consent Form Purpose pB
data must consider consent & revocation ‣ Privacy-by-design via workflows privacy-aware? S.I. Besik, Managing Consent in Workflows under GDPR, February 20, ’20 / 21 20 ‣What are needed to handle consent in workflows? ‣Data-Aware Workflow Consent Policy Consent Form
irembesik
koide3
nttcom
hopin
herumi
morishtr
.png){kind=avatar}
satai
kanekomasahiro
hf149
skoyamalab
masakat0
ks91
trafficbrain
maggiecrowley
lara
reverentgeek
chriscoyier
elsirapls
smashingmag
3n
aleyda
portentint
orderedlist
inesmontani
axbom
