Consumer Identity & Access Management: Consent Management
By: Ciam Design
Tags: Access Management, Consumer, Identity, Identity Management, Digital Transformation

The following is an excerpt from chapter 3 of Consumer Identity & Access Management Design Fundamentals, estimated release January 2021.

Consent Management

Let us change gears again, and take a look at a major requirement when building systems holding consumer related data — that of consent. Consent plays a major role in user interactions and is a key component in both the building of trust and regulatory compliance.

Consent plays a significant part in many different end user interactions — from how and what data can be collected and used, through to the sharing of that data within individuals and third party systems.

Privacy -v- Personalisation

Consent sits within the seemingly paradoxical world of privacy and personalisation. When individuals are asked directly simple questions such as “do you value your privacy” or “do you want your data being kept private”, the answer is invariably “YES!”. However, not all of our actions are consistent with that behaviour.

Privacy is typically focused on the controlled confidentiality of personally identifiable information (PII). Secrecy on the other hand, is typically associated with computerized functions, such the keeping of cryptographic keys away from prying eyes. The definitions are not necessarily strict, but the subtlety is important, as I think it also generates some of the reasons surrounding behavioural mismatches when it comes to privacy.

Privacy is deemed to be more important to us, as it clearly pertains to something that is an extension of us — PII. Information that can be used maliciously against us, or certainly could be used in ways which we may not authorize or encourage. By association we as human entities place high importance on privacy, in the immediacy. However, we typically view future happiness, with less utility as immediate happiness. $10 in your hand right now, seems more appealing than $12 in a week’s time. The same can essentially be applied to privacy — if a barrier to an immediate service, good or experience exists, due to requirements surrounding privacy preservation, consent capture, the vast majority of people are likely to consume the service.

Think of some simple examples.

Do you pause to read all the terms and conditions when signing up to your favourite online movie store?

Do you have several different email addresses for all the different online systems you register for?

Do you distribute buying habits across stores in order to avoid being profiled?

The answer is very likely to be “no” to any or all of the above, resulting in a conflict — similar to that of security versus usability we touched upon in chapter 2.

How can a consumer of a service, receive what they want when they want it via a personalised experience, whilst simultaneously being held in a privacy preserved ecosystem?

There has to be a balanced exchange, between the end user and the service provider — a “coincidence of wants”, where both parties perform an exchange in which both parties can be happy. This is an interesting paradox, especially when no money exchanges hands.

The classic problem, of if something is free, you are the product — meaning our data is essentially what the service provider wants, and often needs, in order to deliver a personalised experience.

As a result we end up in conflict and essentially identify another market failure. There is no incentive for the service provider to uphold your privacy, if that privacy inhibits them from delivering a service, which in turn is how they can generate revenue.

Enter stage left, government regulation.

Regulation

As we know regulatory involvement typically occurs during market failure. A simple example of where perhaps we see a monopolistic supplier of a good or service, which requires an external regulator to provide quasi competitive pressure and oversight. It seems when it comes to privacy, we perhaps have another market failure, with the relatively recent introduction to two big pieces of privacy preserving regulation: The EU’s GDPR and the California state’s CCPA.

GDPR

The GDPR came into effect in May 2018 with essentially two main focus areas:

For people to have more control over their data

For business to have a level playing field for competition

From a consumer perspective, it was about providing a framework where the processing of an individual’s personal data was driven by consent, with that consent based on an affirmative and informed decision. That essentially translates to the end user being made fully aware of what information is being processed, why it is being processed and for the service provider to interrupt the end user to receive a definite positive answer. Typically in the past, a service provider may have received a more implicit answer, based on the user not opting out of a particular condition or signup process. The GDPR removes this ambiguity and forces the service provider to be very explicit regarding information capture and use and provide a solid opportunity for opt in and opt out.

GDPR amplifies the data rights of the end user to the following:

Data protection by default

Data processing information provided to the end user

The right to object for the end user

Ability to access all the data being kept about the end user

Right to be informed if that data is leaked

The right to be forgotten

The intervention of any regulation tends to not occur, if the rights are being upheld “naturally” in the evolving digital landscape. Clearly some organisations would have been supporting those rights by default before the GDPR became binding, but many would not.

So what impact does this have on service providers? There are some basic key principles information designers need to consider when developing digital systems:

Have clearly defined policies for collecting user data

Don’t use the data for any other reason other than that specified

Don’t collect more data than is needed

In turn that extrapolates into deeper requirements for business such as the following:

Check the personal data you collect and process Inform the end user (customer, client, employee) when personal data is collected Keep the personal data for only as long a necessary Secure the data that is being processed Keep and maintain documentation on the data processing activities Make sure the necessary sub contractors abide by the same rules

The above only apply if your business is processing personal data of individuals that reside in the EU — even if the processing entity does not. Clearly if the business resides in the EU too the regulation applies by default.

Many organisations may need to perform a Data Protection Impact Assessment (DPIA) which is a mandatory requirement for organisations that use large amounts of automation, new technologies or there is a higher risk to the end user’s freedom. The DPIA process is there to protect the freedoms of the individual if data such as CCTV or facial recognition technology is being used.

Whilst the service provider seems to have onerous new responsibilities, the EU promotes this as a business opportunity — a normalised set of controls that apply to all EU member countries, allowing a service to offer a compliant experience across lots of different countries at once.

CCPA

The CCPA was also introduced in 2018, primarily focused on the state of California in the United States, with an aim of introducing new privacy rights including:

The right to know about the personal information a business collects about them and how it is used and shared

The right to delete personal information collected from them

The right to opt-out of the sale of their personal information; and

The right to non-discrimination for exercising their CCPA rights

A Californian resident may now ask a business to disclose what personal information they hold about the end user, what they do with it, who they share it with and request that it can be deleted. There is also a right for the business to notify the end user when data is being collected.

The personal data definition under the CCPA, is typically data that is not publicly available, including things like purchase history, browsing history and preferences.

The CCPA needs to be upheld by organisations (other than non-profits or government agencies) either earning more than $25 million per year, holds data on over 50,000 Californian residents or services more than 50% of their revenue from selling data on Californian residents.

Whilst both the GDPR and CCPA are now law, the actual number of organisations being fully compliant is still unknown. The impact of not doing for service providers however can be substantial, with non-compliance for GDPR potentially resulting in a maximum 20 million Euro fine (or 4% annual turnover whichever is the larger). From a CCPA perspective, individuals can only take legal action against a provider in the event of a data breach, that also shows that customer data was not adequately protected — aka was not encrypted or redacted. A statutory damages limit is set at $750 per incident.

Not withholding the monetary impact, the brand damage and potential share price impact of a public non-compliance charge, must also be taken into account.