GDPR. Where to store users consent?
<p>A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt document?</p>

<p>However, I kinda doubt this could be used as a evidence in the future should it be required due to the nature of .txt file. Obviously, it can be edited at any time without any trace. Which kind of indicates the records about consent might have been put there manually after the claim has been raised by the user? As if, forging the evidence.</p>

<p>I tried looking into the information provided by the ICO itself, to find how to correctly store this kind of data (not how to collect it, but where to store it) but can't find anything like that.</p>

<p>Perhaps anyone has any clue where does the data need to be stored for it be accepted as an evidence if required?</p>

<p>Thanks a lot!</p>

<h1>How to store consent</h1>

<p>According to the ICO, you need to store the following:</p>

<ul>
<li><p><strong>Who consented</strong></p>

<p>the name of the individual, or other identifier (eg,
online user name, session ID).</p></li>
<li><p><strong>When they consented</strong></p>

<p>a copy of a dated document, or online
records that include a timestamp; or, for oral consent, a note of the
time and date which was made at the time of the conversation.</p></li>
<li><p><strong>What they were told at the time</strong></p>

<p>A master copy of the document
or data capture form containing the consent statement in use at
that time, along with any separate privacy policy, including version
numbers and dates matching the date consent was given. If consent
was given orally, your records should include a copy of the script
used at that time.</p></li>
<li><p><strong>How they consented</strong></p>

<p>For written consent, a copy of the relevant
document or data capture form. If consent was given online, your
records should include the data submitted as well as a timestamp to
link it to the relevant version of the data capture form. If consent
was given orally, you should keep a note of this made at the time of
the conversation - it doesn’t need to be a full record of the
conversation.</p></li>
<li><p><strong>Whether they have withdrawn consent</strong></p>

<p>And if so, when.</p></li>
</ul>

<p><a href="https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf" rel="nofollow noreferrer">Source (p33/34)</a></p>

<h1>Would a txt file of users who had consented be acceptable</h1>

<p>The ICO provides this example as unacceptable:</p>

<blockquote>
  <p>You keep a spreadsheet with ‘consent provided’ against a
  customer’s name.</p>
</blockquote>

<p><a href="https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf" rel="nofollow noreferrer">Source (p34)</a></p>

<p>This shows that a TXT file of usernames would not be acceptable, as there is not enough information stored</p>

<h1>What would be acceptable</h1>

<p>You would want a table that looks something like this</p>

<pre><code>| UserId | Date | PolicyRevision | Method | WithdrawalDate |
</code></pre>

<h1>How to verify this data has not been modified</h1>

<p>You could store a hash of the row on some form of blockchain, to prove that after the stated date the consent had not been modified, this would prevent having to store a copy of the user's ID on the blockchain. It would not prevent forging consent at the time you claim it was given, but short of having the user digitally sign the transaction with some key that you do not have access to, there would be no way to prevent this.</p>

<p>The method you use to store the information doesn't matter, as long as it is secure. You can store all the textual information you want in a txt file (for example in tab-separated fields), but why not use a database management system to manage this data? For example storing it in a MYSQL database table, which can then be queried and modified much more easily.</p>

<p>As for the "evidence" that a user has actually given consent, I'm afraid it is not possible to really prove it, unless you use specific technologies like blockchains or digital signatures. But does anybody know if blockchain technology compliant with GDPR? Or can we expect every user to own a private key and digitally sign every decision they make? No one is going to do this for now, it would be too difficult to implement and enforce. I believe this part of the law is faulty and can't reasonably be expected to be taken literally or be enforced. All you can do for now is to record as much information as you can about the consent, so that at least it can <em>help</em> you if you ever had to try and demonstrate that a certain user has given consent.  </p>

gdpr data-protection safety