Enhancing Data Protection in Dynamic Consent Management Systems: Formalizing Privacy and Security Definitions with Differential Privacy, Decentralization, and Zero-Knowledge Proofs

• Published in: Sensors (Basel, Switzerland) Vol. 23; no. 17; p. 7604
• Main Authors: Khalid, Muhammad Irfan, Ahmed, Mansoor, Kim, Jungsuk
• Format: Journal Article
• Language: English
• Published: Basel MDPI AG 01.09.2023; MDPI
• Subjects: Clinical trials; Confidentiality; Consent; Data processing; data protection; differential privacy; Digitization; dynamic consent management; General Data Protection Regulation; general data protection regulation (GDPR); Laws, regulations and rules; Personal information; Privacy; privacy by design; Right of privacy; Safety and security measures; security; Germany
• ISSN: 1424-8220; 1424-8220
• DOI: 10.3390/s23177604

Dynamic consent management allows a data subject to dynamically govern her consent to access her data. Clearly, security and privacy guarantees are vital for the adoption of dynamic consent management systems. In particular, specific data protection guarantees can be required to comply with rules and laws (e.g., the General Data Protection Regulation (GDPR)). Since the primary instantiation of the dynamic consent management systems in the existing literature is towards developing sustainable e-healthcare services, in this paper, we study data protection issues in dynamic consent management systems, identifying crucial security and privacy properties and discussing severe limitations of systems described in the state of the art. We have presented the precise definitions of security and privacy properties that are essential to confirm the robustness of the dynamic consent management systems against diverse adversaries. Finally, under those precise formal definitions of security and privacy, we have proposed the implications of state-of-the-art tools and technologies such as differential privacy, blockchain technologies, zero-knowledge proofs, and cryptographic procedures that can be used to build dynamic consent management systems that are secure and private by design.