Skip to content

do not sync date of birth on missing consent

Bengfort requested to merge fix-date-of-birth-attribute into main

If date of birth is used both in the contact data and as an attribute, CASTELLUM_DATE_OF_BIRTH_ATTRIBUTE_ID can be set to automatically sync the values. This becomes an issue if the subject has not given recruitment consent, so there is no legal basis for storing attributes.

So far our approach was to ignore the date of birth attribute in that case. That is not ideal. So I am proposing to delete it instead.

This in turn causes an issue when a subject is added without the intention of having a recruitment consent:

  • The subject is added. At this time we assume that consent will be given at some point, so we sync the date of birth
  • When the wait time is up, we no longer have a legal basis for the attribute and the data protection officer is charged with removing it.

This can be quite annoying for data protection officers. Then again, an annoyance for us is better than excessive data collection of the test subjects.

Merge request reports