Consent, its modalities, dynamics and record-keeping

The paper provides a general introduction to consent as a legal basis for processing personal data; the definition, modalities and dynamics of consent; the data controller’s obligation to enable the data subject to exercise his or her legal power to grant, to refuse or to terminate any permission granted to the data controller with respect to processing the data subject’s personal data; and the data controller’s obligation to demonstrate consent. The paper demonstrates that, through the concept of legal power, result declarations and temporal characterisations of legal effects, one can model, engineer and design systems with actions that perform, give effect to, enforce and record a data subject’s power and declarations to grant permission, to refuse to grant permission or to terminate any permission previously granted to the data controller with respect to processing the data subject’s personal data.