SA09 - Data Provider manages consent assertions

To help understand the content of this document, readers should familiarize themselves with the key definitions and actors.

Overview

This supporting activity describes the set of operations available to a Data Provider within Simpl-Open to create, manage, and revoke consent assertions linked to their data resources. A consent assertion is the technical entity that represents the current validity of the consent given by Data Subjects for the processing of their personal data in relation to a specific dataset. Its status directly drives access control decisions within the data space, ensuring that resource consumption aligns with the current consent status as represented within Simpl-Open.

Consent assertions can be of two types: 

• RESOURCE assertions, which govern access for all Consumers linked to a resource description.
• CONTRACT assertions, which are instantiated automatically during contract negotiation and linked to a specific contract.

Consent assertions do not follow an internal hierarchy. RESOURCE and CONTRACT assertions are siblings that operate independently. Their scope is determined by the entity they are linked to: a RESOURCE assertion applies to all Consumers of a resource description, while a CONTRACT assertion applies exclusively to the Consumer bound by a specific contract. A Data Provider can therefore restrict access for a single Consumer by withdrawing their CONTRACT assertion, without affecting any other Consumer. Both assertion types can coexist on the same resource description: the RESOURCE assertion is linked directly to the resource description, while the CONTRACT assertion is created during contract negotiation and bound to both the resource description and a specific contract.

The management of consent assertions is performed by an End User of Simpl-Open, either through the platform UI or via protected APIs that allow integration with an organisation's external consent platform. Any change to the status of a consent assertion is audited by Simpl-Open and must include a reason.

When a Data Subject withdraws their consent and the dataset is impacted, the Data Controller is responsible for reflecting this change within Simpl-Open by updating the status of the relevant consent assertion accordingly.

Consent withdrawal is not a permanent action. A withdrawn assertion can be reactivated if the consent basis is restored. Simpl-Open is responsible for notifying all affected Consumers whenever the status of a consent assertion changes:

• Withdrawal: Consumers are informed that the dataset is no longer available for consumption. The withdrawal can also be temporary, lasting for the time required for the provider to clean up the dataset and make it available again after removing data subject information. In this case, the withdrawal operation is notified to the consumer, also indicating that the resource may become available in a new version in the future.
• Reactivation: Consumers are informed that the consent basis has been restored by the Data Controller and that a new compliant version of the dataset is available for ingestion according to the contractual obligations established during contract negotiation.

Relationship with other Business Processes:

This supporting activity provides no standalone value. It provides some of the steps required for the consent assertions to be used within the business process related to managing resource descriptions and checking assertion statuses during contract establishment and consumption. Specifically:

• BP05B – Provider manages resource descriptions - During creation, the resource description can be linked to an existing resource consent assertion. The BP will also describe the presence of consent policies that will outline the need to create a contract consent assertion during contract establishment. The supporting activity step that outlines consent assertion creation will be referenced in this business process.
• BP07 - Consumer and Provider establish a usage contract for selected catalogue items - If a dedicated consent policy is linked to the resource description during creation, a contract consent assertion is created and linked to the contract during contract establishment. The supporting activity step outlining consent assertion creation will be referenced in this BP. Additionally, when a resource consent assertion is revoked, contract establishment cannot take place for the related resource consent assertion.
• BP09A – Consumer consumes a data resource from a Provider - Consent assertion statuses are checked before allowing consumption to consumers. 

Actors

The actors involved in this process are:

• Participant representatives with the role required to manage the assertions.

Assumptions

• Simpl-Open does not manage or own data; the Data Controller role is fulfilled entirely by the participant's own organisation.
• Simpl-Open does not manage or validate GDPR consent; participants remain responsible for maintaining consent records in their own systems. Simpl-Open only manages technical representations (consent assertions) provided by participants. Simpl-Open does not maintain mappings between datasets and individual Data Subjects. It relies on the Data Controller to manage such mappings and to update consent assertions accordingly.

Prerequisites

The following prerequisites must be fulfilled:

• Data Provider onboarded: The Data Provider must be successfully onboarded (Business Process 3A).

Details

Trigger consent assertion configuration

The Data Provider user initiates the consent assertion management activity for which the consent configuration action is required.

SA09.01 Create resource consent assertion

The Data Provider creates a consent assertion of type RESOURCE, governing access for all Consumers bound to the resource description, and of type CONTRACT, governing dataset consumption exclusively for the Consumer involved in a specific contract. In both cases, the assertion is set to ACTIVE status upon creation and its status is considered during policy enforcement and contract validation when determining access for Consumers. The RESOURCE assertion is linked directly to a Resource Description, while the CONTRACT assertion is instantiated during contract negotiation when the resource description is configured to require a per-contract consent assertion.

SA09.02 - Withdraw consent assertion

The Data Provider, withdraws a consent assertion by changing its status to WITHDRAWN. The withdrawal must always include a reason and is fully audited.

SA09.03 - Reactivate consent assertion

The Data Provider, or an authorised external application, restores a previously withdrawn consent assertion to ACTIVE status, providing a reason for the reactivation, triggering the notification of all Consumers bound to the assertion that the dataset is once again available for consumption.

SA09.04 - Notify consent assertion status change

The Data Provider notifies all Consumers bound to the consent assertion whenever its status changes, informing them that the dataset is no longer available for consumption in the event of a withdrawal, or that a new compliant version is available for ingestion in the event of a reactivation.

Consent assertion configured

The consent assertion has been successfully configured.

Consent assertion withdrawn

The consent assertion has been successfully withdrawn.

Consent assertion reactivated

The consent assertion has been successfully reactivated after a previous withdrawal.