{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,24]],"date-time":"2026-07-24T10:16:44Z","timestamp":1784888204343,"version":"3.55.0"},"reference-count":56,"publisher":"MDPI AG","issue":"23","license":[{"start":{"date-parts":[[2021,11,30]],"date-time":"2021-11-30T00:00:00Z","timestamp":1638230400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"the MSIT (Ministry of Science and ICT) of the Korean Government","award":["National Research Foundation of Korea (NRF): No. NRF-2021R1A2C2012476"],"award-info":[{"award-number":["National Research Foundation of Korea (NRF): No. NRF-2021R1A2C2012476"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>A massive amount of sensitive personal data is being collected and used by scientists, businesses, and governments. This has led to unprecedented threats to privacy rights and the security of personal data. There are few solutions that empower individuals to provide systematic consent agreements on distinct personal information and control who can collect, access, and use their data for specific purposes and periods. Individuals should be able to delegate consent rights, access consent-related information, and withdraw their given consent at any time. We propose a smart-contract-based dynamic consent management system, backed by blockchain technology, targeting personal data usage under the general data protection regulation. Our user-centric dynamic consent management system allows users to control their personal data collection and consent to its usage throughout the data lifecycle. Transaction history and logs are recorded in a blockchain that provides trusted tamper-proof data provenance, accountability, and traceability. A prototype of our system was designed and implemented to demonstrate its feasibility. The acceptability and reliability of the system were assessed by experimental testing and validation processes. We also analyzed the security and privacy of the system and evaluated its performance.<\/jats:p>","DOI":"10.3390\/s21237994","type":"journal-article","created":{"date-parts":[[2021,12,1]],"date-time":"2021-12-01T01:45:02Z","timestamp":1638323102000},"page":"7994","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":63,"title":["A Smart Contract-Based Dynamic Consent Management System for Personal Data Usage under GDPR"],"prefix":"10.3390","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8458-4706","authenticated-orcid":false,"given":"Mpyana Mwamba","family":"Merlec","sequence":"first","affiliation":[{"name":"Department of Computer Science and Engineering, Korea University, Seoul 02841, Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4569-2640","authenticated-orcid":false,"given":"Youn Kyu","family":"Lee","sequence":"additional","affiliation":[{"name":"Department of Computer Engineering, Hongik University, Seoul 04066, Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4391-7313","authenticated-orcid":false,"given":"Seng-Phil","family":"Hong","sequence":"additional","affiliation":[{"name":"Management Support Division, Hancom WITH, Inc., Pangyo 13493, Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4192-4122","authenticated-orcid":false,"given":"Hoh Peter","family":"In","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Korea University, Seoul 02841, Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2021,11,30]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"e19139","DOI":"10.2196\/19139","article-title":"COVID-19 mobile positioning data contact tracing and patient privacy regulations: Exploratory search of global response strategies and the use of digital tools in Nigeria","volume":"8","author":"Ekong","year":"2020","journal-title":"JMIR mHealth uHealth"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"2487","DOI":"10.1590\/1413-81232020256.1.11792020","article-title":"Personal data usage and privacy considerations in the COVID-19 global pandemic","volume":"25","author":"Almeida","year":"2020","journal-title":"Sa\u00fade Colet"},{"key":"ref_3","unstructured":"Park, O., Park, Y.J., Park, S.Y., Kim, Y.M., Kim, J., Lee, J., Park, E., Kim, D., Jeon, B.H., and Ryu, B. (2020). Contact transmission of Covid-19 in South Korea: Novel investigation techniques for tracing contacts. Osong Public Health Res. Perspect., 2487\u20132492."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"463","DOI":"10.1038\/s41591-020-0832-5","article-title":"On the responsible use of digital data to tackle the COVID-19 pandemic","volume":"26","author":"Ienca","year":"2020","journal-title":"Nat. Med."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Voigt, P., and Von dem Bussche, A. (2017). The Eu General Data Protection Regulation (GDPR): A Practical Guide, Springer International Publishing. [1st ed.].","DOI":"10.1007\/978-3-319-57959-7"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Teare, H.J., Teare, H.J., Morrison, M., Whitley, E.A., and Kaye, J. (2015). Towards \u2018Engagement 2.0\u2032: Insights from a study of dynamic consent with biobank participant. Digit. Health, 1.","DOI":"10.1177\/2055207615605644"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"141","DOI":"10.1038\/ejhg.2014.71","article-title":"Dynamic consent: A patient interface for twenty-first century research networks","volume":"23","author":"Kaye","year":"2015","journal-title":"Eur. J. Hum. Genet."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"897","DOI":"10.1038\/ejhg.2012.282","article-title":"Broad consent versus dynamic consent in biobank research: Is passive participation an ethical problem?","volume":"21","author":"Steinsbekk","year":"2013","journal-title":"Eur. J. Hum. Genet."},{"key":"ref_9","unstructured":"Scott, A.S., Goldsmith, M., and Teare, H. (2018). Wider Research Applications of Dynamic Consent. IFIP International Summer School on Privacy and Identity Management, Springer."},{"key":"ref_10","first-page":"1","article-title":"Dynamic Consent: A potential solution to some of the challenges of modern biomedical research","volume":"18","author":"Teare","year":"2017","journal-title":"BMC Med. Ethics"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Asghar, M.R., and Russello, G. (2011). Flexible and Dynamic Consent-Capturing. International Workshop on Open Problems in Network Security, Springer.","DOI":"10.1007\/978-3-642-27585-2_10"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"175","DOI":"10.1177\/1556264619887073","article-title":"Dynamic Consent: An Evaluation and Reporting Framework","volume":"15","author":"Prictor","year":"2020","journal-title":"J. Empir. Res. Hum. Res. Ethic"},{"key":"ref_13","unstructured":"Mont, M.C., Sharma, V., and Pearson, S. (2021, November 25). EnCoRe: Dynamic Consent, Policy Enforcement and Accountable Information Sharing within and across Organisations. Available online: https:\/\/www.hpl.hp.com\/techreports\/2012\/HPL-2012-36.pdf."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"169","DOI":"10.1007\/978-3-030-50086-3_10","article-title":"A Formal Framework for Consent Management","volume":"Volume 12136","author":"Tokas","year":"2020","journal-title":"International Conference on Formal Techniques for Distributed Objects, Components"},{"key":"ref_15","first-page":"GKR","article-title":"Blockchain for consent management in the eHealth environment: A nugget for privacy and security challenges","volume":"5","author":"Genestier","year":"2017","journal-title":"J. Int. Soc. Telemed. Ehealth"},{"key":"ref_16","unstructured":"Camilo, J. (2019). Blockchain-based consent manager for GDPR compliance. Open Identity Summit 2019, Gesellschaft f\u00fcr Informatik."},{"key":"ref_17","unstructured":"Rupasinghe, T., Burstein, F., and Rudolph, C. (2019, January 15\u201318). Blockchain based Dynamic Patient Consent: A Privacy-Preserving Data Acquisition Architecture for Clinical Data Analytics. Proceedings of the International Conference on Information Systems 2019, Munich, Germany."},{"key":"ref_18","unstructured":"(2021, November 25). InterPlanetary File System. Available online: https:\/\/github.com\/ipfs-shipyard\/ipfs-desktop."},{"key":"ref_19","unstructured":"(2021, November 25). Quorum: A Permissioned Implementation of Ethereum Supporting Data Privacy. Available online: https:\/\/github.com\/ConsenSys\/quorum."},{"key":"ref_20","unstructured":"Nakamoto, S. (2008). Bitcoin: A peer-to-peer electronic cash system. Decentralized Bus. Rev., 21260. Available online: https:\/\/www.ussc.gov\/sites\/default\/files\/pdf\/training\/annual-national-training-seminar\/2018\/Emerging_Tech_Bitcoin_Crypto.pdf."},{"key":"ref_21","first-page":"1","article-title":"Ethereum: A secure decentralised generalised transaction ledger","volume":"151","author":"Wood","year":"2014","journal-title":"Ethereum Proj. Yellow Pap."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Xu, X. (2017, January 3). A Taxonomy of Blockchain-Based Systems for Architecture Design. Proceedings of the 2017 IEEE International Conference on Software Architecture (ICSA), Gothenburg, Sweden.","DOI":"10.1109\/ICSA.2017.33"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Androulaki, E., Barger, A., Bortnikov, V., Cachin, C., Christidis, K., De Caro, A., Enyeart, D., Ferris, C., Laventman, G., and Manevich, Y. (2018, January 23). Hyperledger Fabric: A Distributed Operating System for Permissioned Blockchains. Proceedings of the Thirteenth EuroSystem Conference, Porto, Portugal.","DOI":"10.1145\/3190508.3190538"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"143734","DOI":"10.1109\/ACCESS.2020.3014565","article-title":"Consent Model for Blockchain-Based Health Data Sharing Platforms","volume":"8","author":"Jaiman","year":"2020","journal-title":"IEEE Access"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"193102","DOI":"10.1109\/ACCESS.2020.3032553","article-title":"Blockchain for Giving Patients Control over Their Medical Records","volume":"8","author":"Madine","year":"2020","journal-title":"IEEE Access IEEE Access"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"225777","DOI":"10.1109\/ACCESS.2020.3045048","article-title":"Fully Decentralized Multi-Party Consent Management for Secure Sharing of Patient Health Records","volume":"8","author":"Madine","year":"2020","journal-title":"IEEE Access"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"4909","DOI":"10.1007\/s12652-020-01761-1","article-title":"Dynamic consent management for clinical trials via private blockchain technology","volume":"11","author":"Albanese","year":"2020","journal-title":"J. Ambient. Intell. Humaniz. Chomput."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"609","DOI":"10.1038\/s41431-019-0560-9","article-title":"Dwarna: A blockchain solution for dynamic consent in biobanking","volume":"28","author":"Mamo","year":"2019","journal-title":"Eur. J. Hum. Genet."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Bhaskaran, K., Ilfrich, P., Liffman, D., Vecchiola, C., Jayachandran, P., Kumar, A., Lim, F., Nandakumar, K., Qin, Z., and Ramakrishna, V. (2018, January 17\u201320). Double-Blind Consent-Driven Data Sharing on Blockchain. Proceedings of the IEEE International Conference on Cloud Engineering (IC2E), Orlando, FL, USA.","DOI":"10.1109\/IC2E.2018.00073"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1155\/2019\/1431578","article-title":"A blockchain-based platform for consent management of personal data processing in the IoT ecosystem","volume":"2019","author":"Rantos","year":"2019","journal-title":"Secur. Commun. Netw."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Rantos, K., Drosatos, G., Demertzis, K., Ilioudis, C., Papanikolaou, A., and Kritsas, A. (2018). ADvoCATE: A Consent Management Platform for Personal Data Processing in the Iot Using Blockchain Technology. Innovative Security Solutions for Information Technology and Communications, Springer.","DOI":"10.1007\/978-3-030-12942-2_23"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Agarwal, R.R., Kumar, D., Golab, L., and Keshav, S. (2020, January 2). Consentio: Managing Consent to Data Access Using Permissioned Blockchains. Proceedings of the 2020 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), IEEE, Toronto, ON, Canada.","DOI":"10.1109\/ICBC48266.2020.9169432"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Lakhan, A., Mohammed, M.A., Rashid, A.N., Kadry, S., Panityakul, T., Abdulkareem, K.H., and Thinnukool, O. (2021). Smart-Contract Aware Ethereum and Client-Fog-Cloud Healthcare System. Sensors, 21.","DOI":"10.3390\/s21124093"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Pandit, H.J., Debruyne, C., O\u2019Sullivan, D., and Lewis, D. (2019). GConsent-a Consent Ontology Based on the GDPR. European Semantic Web Conference, Springer.","DOI":"10.1007\/978-3-030-21348-0_18"},{"key":"ref_35","unstructured":"Rissanen, E. (2014). Xacml v3. 0 Core and Hierarchical Role-Based Access Control (RBAC) Profile Version 1.0: Committee Specification 02, Organization for the Advancement of Structured Information Standards (OASIS)."},{"key":"ref_36","unstructured":"Brossard, D. (2014). JSON Profile of XACML 3.0 Version 1.0, vol. 1: Candidate OASIS Standard 01, Organization for the Advancement of Structured Information Standards (OASIS)."},{"key":"ref_37","unstructured":"(2021, November 25). Cakeshop. Available online: https:\/\/github.com\/ConsenSys\/cakeshop."},{"key":"ref_38","unstructured":"(2021, November 25). Tessera. Available online: https:\/\/github.com\/consensys\/tessera."},{"key":"ref_39","unstructured":"(2021, November 25). Constellation. A Self-Managing Peer-to-Peer System. Available online: https:\/\/bit.ly\/3kaVrmv."},{"key":"ref_40","unstructured":"(2021, November 25). Istanbul Byzantine Fault Tolerant. Available online: https:\/\/bit.ly\/3kAw51J."},{"key":"ref_41","unstructured":"Ongaro, D., and Ousterhout, J. (2014, January 19\u201320). In Search of an Understandable Consensus Algorithm. Proceedings of the USENIX Annual Technical Conference ({USENIX} {ATC} 14, Philadelphia, PA, USA."},{"key":"ref_42","unstructured":"(2021, November 25). cAvisior. Available online: https:\/\/github.com\/google\/cadvisor."},{"key":"ref_43","unstructured":"(2021, November 25). Quorum Reporting. Available online: https:\/\/github.com\/ConsenSys\/quorum-reporting."},{"key":"ref_44","unstructured":"(2021, November 25). Splunk App for Quorum. Available online: https:\/\/splk.it\/3qg6myV."},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"So, S., Lee, M., Park, J., Lee, H., and Oh, H. (2020, January 30). VeriSmart: A Highly Precise Safety Verifier for Ethereum Smart Contracts. Proceedings of the IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP40000.2020.00032"},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Tikhomirov, T., Voskresenskaya, E., Ivanitskiy, I., Takhaviev, R., Marchenko, E., and Alexandrov, Y. (2018, January 27). Smartcheck: Static Analysis of Ethereum Smart Contracts. Proceedings of the 1st International Workshop on Emerging Trends in Software Engineering for Blockchain, Gothenburg, Sweden.","DOI":"10.1145\/3194113.3194115"},{"key":"ref_47","unstructured":"Baliga, A., Subhod, I., Kamat, P., and Chatterjee, S. (2018). Performance evaluation of the quorum blockchain platform. arXiv, Available online: https:\/\/arxiv.org\/pdf\/1809.03421.pdf."},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Bieker, F., Friedewald, M., Hansen, M., Obersteller, H., and Rost, M. (2016). A Process for Data Protection Impact Assessment Under the European General Data Protection Regulation. Annual Privacy Forum, Springer.","DOI":"10.1007\/978-3-319-44760-5_2"},{"key":"ref_49","unstructured":"Health Information and Quality Authority (2021, November 25). Guidance on Privacy Impact Assessment in Health and Social Care: Version 2.0. Available online: https:\/\/bit.ly\/2Yqp2kf."},{"key":"ref_50","doi-asserted-by":"crossref","unstructured":"Mazzoni, M., Corradi, A., and Di Nicola, V. (2021). Performance evaluation of permissioned blockchains for financial applications: The ConsenSys Quorum case study. Blockchain Res. Appl., 100026.","DOI":"10.1016\/j.bcra.2021.100026"},{"key":"ref_51","unstructured":"Egberts, A. (2021, November 25). The Oracle Problem\u2014An Analysis of How Blockchain Oracles Undermine the Advantages of Decentralized Ledger Systems. SSRN 3382343. Available online: https:\/\/papers.ssrn.com\/sol3\/papers.cfm?abstract_id=3382343."},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Caldarelli, G. (2020). Understanding the Blockchain Oracle Problem: A Call for Action. Information, 11.","DOI":"10.3390\/info11110509"},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"tyy001","DOI":"10.1093\/cybsec\/tyy001","article-title":"Forgetting personal data and revoking consent under the GDPR: Challenges and proposed solutions","volume":"4","author":"Politou","year":"2018","journal-title":"J. Cybersecur."},{"key":"ref_54","doi-asserted-by":"crossref","first-page":"322","DOI":"10.1016\/j.icte.2021.08.003","article-title":"Securing biometric authentication system using blockchain","volume":"7","author":"Lee","year":"2021","journal-title":"ICT Express"},{"key":"ref_55","first-page":"361","article-title":"Automated Legal Compliance Checking by Security Policy Analysis","volume":"10489","author":"Ranise","year":"2017","journal-title":"International Conference on Computer Safety, Reliability and Security"},{"key":"ref_56","doi-asserted-by":"crossref","unstructured":"Torre, D., Soltana, G., Sabetzadeh, M., Briand, L.C., Auffinger, Y., and Goes, P. (2019, January 15\u201320). Using Models to Enable Compliance Checking Against the GDPR: An Experience Report. Proceedings of the ACM\/IEEE International Conference on Model Driven Engineering Languages and Systems (MoDELS), Munich, Germany.","DOI":"10.1109\/MODELS.2019.00-20"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/23\/7994\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T07:37:51Z","timestamp":1760168271000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/23\/7994"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,11,30]]},"references-count":56,"journal-issue":{"issue":"23","published-online":{"date-parts":[[2021,12]]}},"alternative-id":["s21237994"],"URL":"https:\/\/doi.org\/10.3390\/s21237994","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,11,30]]}}}