OConsent -- Open Consent Protocol for Privacy and Consent Management with Blockchain

TL;DR

This paper introduces OConsent, a blockchain-based protocol and platform designed to enhance transparency, control, and compliance in personal data management for users, data controllers, and privacy officers.

Contribution

It presents a novel open consent protocol leveraging blockchain to track, manage, and enforce data privacy policies throughout the data lifecycle.

Findings

Provides a transparent data processing lifecycle

Enables real-time privacy breach alerts

Supports policy enforcement through blockchain

Abstract

In the current connected world - Websites, Mobile Apps, IoT Devices collect a large volume of users' personally identifiable activity data. These collected data is used for varied purposes of analytics, marketing, personalization of services, etc. Data is assimilated through site cookies, tracking device IDs, embedded JavaScript, Pixels, etc. to name a few. Many of these tracking and usage of collected data happens behind the scenes and is not apparent to an average user. Consequently, many Countries and Regions have formulated legislations (e.g., GDPR, EU) - that allow users to be able to control their personal data, be informed and consent to its processing in a comprehensible and user-friendly manner. This paper proposes a protocol and a platform based on Blockchain Technology that enables the transparent processing of personal data throughout its lifecycle from capture, lineage to redaction. The solution intends to help service multiple stakeholders from individual end-users to Data Controllers and Privacy Officers. It intends to offer a holistic and unambiguous view of how and when the data points are captured, accessed, and processed. The framework also envisages how different access control policies might be created and enforced through a public blockchain including real time alerts for privacy data breach.