Consent Management Platform

The Partisia Consent Management Platform utilizes a private blockchain to store and manage consents. The properties of the blockchain ensures a detailed audit trail, where all actions can be traced back to the individual that carried out the action.

Components

The Partisia Consent Management Platform consists of the three components

SSO
Key Management (not needed by Service Providers)
Blockchain

The SSO service is responsible for the authentication of users (data subjects). The Key Management service holds the private key of the end users (Service Providers are expected to hold their own private key). Finally, the blockchain is responsible for the actual management and storage of the consents.

Demo environment

For the demo environment, the url is:

https://consent-node-server.platform.demo1.partisia.com

The API exposed by the blockchain node is documented with swagger that can be accessed here.

As the consents are stored on a blockchain, the only way to change a state is by sending a signed transaction to the /transaction endpoint. The state of the consents can be read through multiple GET endpoints.

Roles

In the Partisia Consent Management Platform we have two kinds of actors:

Data Subject The actor that is using a service that requires consent.
Service provider The actor providing the service that needs a consent from the data subject.

MyHealthWallet web application

The MyHealthWallet is where the data subject can manage their consents. In the demo environment, it can be accessed at

https://my-health-wallet.platform.demo1.partisia.com

As a Service Provider, if you need consent from a data subject, you can redirect the user to the following URL:

https://my-health-wallet.platform.demo1.partisia.com/consents/{consentId}/response

Remember to request consent from the data subject before you redirect them to the MyHealthWallet.

Data subject actions

This section is only relevant, if you do not want to use the MyHealthWallet.

As a data subject, you can:

Give consent
Withdraw consent
View all consents

A consent is given (or withdrawn) by sending a signed transaction to the blockchain. The transaction is of the following structure.

<Transaction> := {
    nonce: 0xnn*8                           (big-endian)
    validToTime: 0xnn*8                     (big-endian)
    gasCost: 0xnn*8                         (big-endian)
    address: 0xnn*21
    rpc : Rpc
}

The nonce should match the data subject that is giving/withdrawing consent. See how to fetch the nonce in the swagger documentation.
The address is the id of the consent specification.
The RPC is where we specify whether we want to give or withdraw consent using the give RPC or the withdraw RPC.

For more information on how to build the transaction go here.

The final step is to create the signature using the key management service. Combining the transaction and the signature gives us the signed transaction that can be sent to the blockchain.

View all consents

A data subject can view all consents given by that data subject (and all requested consents) by calling the consent/me endpoint. The data subject is authenticated by supplying the SSO token in the authorization header of the request. For more details see the swagger documentation.

Service provider actions

As a service provider, you can:

Request consent
Utilize a consent
View consented data subject(s)

To request or utilize consent from a data subject, a transaction must be sent to the blockchain. The transaction is similar to the transaction used to give or withdraw consent.

The only difference is to use the request RPC or utilize RPC instead, and then not use the key management service to sign the transaction. Service Providers should instead sign the transactions using a private key held by themselves. For more details see here.

View consented data subject(s)

If the service provider is registered as the data controller of a consent specification, the service provider can get a list of all the data subjects that have consented to that consent specification.

The service provider can check if the data subject has consented to the consent specification, if the provider has the consent specification id and the data subject id.

See how to retrieve this information under Consent Specification in the swagger documentation

Unauthenticated actions

All data subjects and service providers can view all consent specifications and their public information. The public information of a consent specification is the text, title, data controller etc., but not anything about the data subjects that have consented to the consent specification.