Handling a New Customer Registration

When a new customer (aka a data subject) is registered inside the client's CRM web app or equivalent the client assigns them a corresponding customer Identity with an Event API (see “Obtaining Future Identities”).

Processing of records requires collecting consent from the data subjects. This consent may later be revoked. Both the collection and revocation of consent are tracked as Events. To facilitate this use case, the Events API provides pre-configured Event Types that are part of the GiveConsentEvent and RevokeConsentEvent Event Type Families. These EventTypes will be used in sensors within information systems when customer actions relevant to registration (during which time consent must be obtained) and revocation of consent occur within the system.

As a specific example, consider the workflow for subscribing to a newsletter.

When subscribing to a newsletter, certain pieces of information might be required from the data subject (such as the email address to which the newsletter is delivered) while other information might be optional (such as demographic information about the data subject). The optional information should only be collected if the data subject agrees to provide it and if it is not provided that should not be an obstacle to the essential functionality of the subscription.

The entry form to collect the data for the subscription would contain text input fields for the required data elements (e.g. an email), optional pieces of data (e.g. First Name and Last Name) as well as a checkbox that when checked indicates the user consents to receive emails and a button to “Subscribe.” Clicking on this “Subscribe” button should result in the creation of two Events through the Events API:

an Event belonging to the GiveConsentEvent Event Type Family
an Event that is an instance of a customized and specific Event Type called SubscriptionEvent

The SubscriptionEvent will be considered to be the “start event” of the Data Storage Duration Rule that is part of the Processing Record maintained by the Events API. A subsequent revocation of the consent would be considered the “stop event.”