To innovate: privacy legal framework provide a legal standard called “Privacy as Expected” in which the expectations for data processing are shared between the PII Principal (Individual) and the PII Controller (Service Provider via a RP).
Receipts when compared - provide a tool for innovation for decentralized legal governance. The ANCR v1.2 Framework needs to be usable for lawyers and identity protocols, and enable the enhancement of existing privacy policies wit clauses that are applied based on context.
Notice Receipt Types
This is a (N&)Consent Receipt v1.2 and updates the v1.1 with a notice receipt types, which is used as standard semantic basis for data processing and receipt generation.
To implement this specification choose the receipt type for the legal justification, display the consent label in the receipt and privacy rights information access for the context of processing
The notice receipt is extended by the legal justification for processing
Each type of Notice receipt is defined by a legal justification mapped to a consent type label for human record processing and privacy rights.
The legal justifications are represented generically, and based on those defined in the GDPR and guidelines like those found in Canadian privacy for meaningful consent.
Table 1: Receipt Types for Legal Justifications & Consent Type Labels for Notice Liability Transfer
Master Data Controls - matching - Privacy Rights to data controls that re specified for data context governance and trust.
“Consent is not the only lawful basis for the processing of PII and thus not always required. “
In some jurisdictions, other lawful basis includes
consent
contractual necessity,
compliance with legal obligations,
vital interest,
public interest, and
legitimate interests
[ISO/IEC 29184]
Receipt Type | GDPR Legal Justification | Definition | Privacy Rights (7) | Consent Type Label - Profile Label (Art 30) | Liability Controller / Provider liability in the chain for personal data |
---|---|---|---|---|---|
#FakePrivacy | NA | when their are not enough information elements for a notice to provide a consent type. | N/A - To provide legal notice - which includes what notice Fake Notice Should Be Reported by Investigator | no legal justification type detected or contact of adhesion defined as consent | OPN-MDC-Receipt transfers liability.
|
Contract Notice Receipt | Contractual Necessity | personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis, laid down by law, either in this Regulation or in other Union or Member State law as referred to in this Regulation, including the necessity for compliance with the legal obligation to which the controller is subject or the necessity for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. | Subject Access, Rectification, Restrict Processing (3) Note; must by binding on processors to be valid. | Implicit-Contractual Necessity | |
Legal Notice Receipt | Legal Obligation | processing is necessary for compliance with a legal obligation to which the controller is subject. | Subject Access, Rectification, Restrict Processing (3) | Consent Not Applicable | |
Emergency Notice Receipt | Best/Vital Interest of Data Subject, | When consent is not required is when it is legally deemed in the best interest of the data subject to disclose and process personal information. Vital interests are intended to cover only interests that are essential for someone's life. | Subject Access, Rectification, Restrict Processing, Automated Individual Decision Making(4) | No Consent is Needed | |
Public Notice Receipt | Public Interest, Public Org Surveillance | ask carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e) and Recital 45 | Subject Access, Rectification, Restrict Processing, Object, Automated Individual Decision Making (5) | Consent Not Required | |
Legitimate Notice Receipt | Legitimate Interest |
| Subject Access, Rectification, Erasure, Restrict Processing, Object, Automated Individual Decision Making (6) | No Consent Needed | |
Consent Notification Receipt | Consent | consent is implicit by the action of PII Principle, in accordance with a Notice or Notification | Subject Access, Rectification, Erasure, Restrict Processing, Object, Automated Individual Decision Making (6) | Implicit Consent | |
Implied-Consent Notice Receipt | Consent - Explicit Consent | consent is in some way implied through the action of the person, e.g. walking through door, entering personal data in a form, or opting-out | Subject Access, Rectification, Erasure, Restrict Processing, Data.Portability (5) | Implied Consent | |
Consent Notice Receipt (ISO 29184 Appendix) | Consent | a notice and consent receipt which provides a record of an explicit consent. | Subject Access, Rectification, Erasure, Restrict Processing, Data.Portability (5) | Explicit Consent | |
Altruistic Consent Notice Receipt | Consent - Explicit (pre)defined consent | the Person defines the privacy requirements of the consent in a Privacy Agreement, where the individual understands and is aware, because the person set the terms. The consent still needs to conform to the legal requirements of Explicit Consent |
| Consent Directive - Certified Awareness Level |