ispirt/depa

depa's Issues

Spec for consent wallet portability

Support for portability across the consent wallets provided by different consent managers (like CM_1 and CM_2 are the providers of consent wallets).

option 1 - user has a new CM id and consent lifecycle data is moved from old to this new CM id.
In this who will inform the DPs and DCs that user has migrated from user CM_1 to CM_2 ? user itself or should it be part of the spec itself ?

option 2 - user just changes its CM provider. The users cm id will not change. Similar to how mobile portability works. The lifecycle data will still have to be moved.

Thought - for consent lifecycle data movement user could add the old CM as the DP to the new CM.

Consent Revocation from DP / DC

Can we also have a consent lifecycle being managed from DP or DC also ??

Handling of guardian and nominee

requirement. guardian/nominee should be able to provide the consent on the data principal behalf. This will require DP to honor the consent given by the nominee/guardian.

data frequency in consent request

the current spec doesn't allow for defining frequency like -
2 time every month on 5th and 15th day of month.

Multi user consent

There can be cases where the DP needs the consent from multiple parties to execute the request. like in case of a joint account of user A and B.

Indirect linking flow

Should we have indirect linking similar to HIF ? This will require account discovery also which is not there in DEPA 2.0

consent delegation

Requirement:-

1. User (a delegator) should be able to delegate the consent management to another user (a subordinate ).
2. can a subordinate further delegate it ?? who decides to what level the delegation can be done ??
3. what if the subordinate is moved to a new delegator ??
4. what if consent management has to be moved from one subordinate to another ??