Enabling data sovereignty for patients through digital consent enforcement

Digital medical data offers an opportunity to improve medical diagnosis and caregiving. While a single doctor might not have enough patients to spot significant factors, data becomes much more evaluable once different doctors combine their data. Data evaluation across multiple data sources will be more practical with the increasing level of digitalization. While the potential benefits of a broad data analysis are enormous, there is a huge potential privacy impact for patients. To cope with legal regulations, for example the European General Data Protection Regulation (GDPR) and to give patients more control over the usage of their data, new tools are needed. Digital distributed patient records need a mechanism to manage a digital declaration of consent. There are some concepts how to digitize medical consent, but still there is no complete workflow that automatically evaluates and enforces consent for the usage of personal medical data. In this paper we will present a continuous digital consent enforcement workflow. Patients can define a detailed declaration of consent for their medical data and researchers can request data through a dedicated interface that enforces that consent. We show the feasibility of this workflow by presenting a prototype implementation and evaluating the system against defined requirements for informed consent.