ITCoP input
Evidence of notice and consent
Why we are asking, and what the survey is for.
Every day people are told who is collecting their data and why, and are asked to agree. Very little of that leaves evidence anyone can use later. The person keeps nothing. The organisation keeps its own account. When a regulator asks what a notice said on a given day, who showed it and whether it came before the consent, the answer is often a reconstruction.
We think that evidence should exist by default, and that it should be the same kind of evidence everywhere, so it works across organisations and across borders.
What evidence would look like
- The organisation responsible is identified before the person is asked to identify themselves.
- Each notice has a version, and earlier versions can be retrieved.
- Changes to a notice are recorded in a log others can inspect.
- The person can hold their own record of what they were told and what they agreed to, a receipt.
- A regulator can check all of this from published records, without access to anyone's personal data.
Where international standards stand
International standards already cover part of this. ISO/IEC 29100 sets out the privacy framework and its roles. ISO/IEC 29184 sets out what an online privacy notice should contain and how consent is obtained. ISO/IEC TS 27560:2023 sets out a structure for consent records. The open question is whether, together, they produce evidence that a person, an organisation and a regulator can each rely on, or whether something is missing. The consent receipt that today's consent record standards build on was designed to give the person evidence, not only the organisation. We want to know whether that need is still met.
The code of practice
We support the development of the Internet Transparency Code of Practice (ITCoP): a code organisations can adopt and regulators can inspect, built on standards that exist. Before its requirements are written, we are asking the people who would use the evidence what it needs to show.
What we are asking
- Experts in standards, law, policy and implementation: the expert survey, about fifteen minutes.
- Supervisory authorities: a survey on how transparency is checked in practice today (coming soon).
Answer only what is within your expertise. Every question is optional.
What happens with the answers
Responses are reported in summary. No person or organisation is named without consent. You are given a receipt number before you answer, and you can use it to withdraw your response at any time. The summary will be published and shared with everyone who took part.
The survey is ours, and independent of any standards body.