Consent_Management

Consent Management
===================
Review of the legal basis for data processing
-----------------------------------------------------------

There are three options that justify **Legal basis for data processing**:
- **Recruitment consent** (Art. 6 (1) lit. a, Art. 9 (2) lit. a GDPR)
- **Study consent** (Art. 6 (1) lit. a, Art. 9 (2) lit. a GDPR and Art. 27 BDSG)
- **Guardianship** (Art. 6 (1) lit. a, Art. 9 (2) lit. a DSGVO and Art.
  1626, 1902 BGB)
  
Castellum is mainly used for the management of **Recruitment consent**. **Study 
consents** must be obtained separately from the database by the respective 
**Study conductor** at the execution level

1. Log in to Castellum by entering your username and password
   Please make sure you have a stable internet connection and use your right 
   username and password
   
2. Click on **Admin** on the front page

3. Go to **Consent documents** in the **Subjects**-field
   - There you will see a list of all consent documents that have already been
     created
   - As additional information, the date of creation and the validity of the
     consent document are displayed
     
Updating consent forms
----------------------
Consent documents are marked as invalid if a change in the law occurs,
significant changes are made to the old document, or other reasons require the
subjects's signature on a new document

1. There are two options that can be implemented when a consent document becomes
   invalid.
   - For both options, first go to **Admin** at the front page > **Consent
     documents** > click on the creation date of the consent document to be
     modified

1.1. The consent document can be marked as **Is valid** AND **Is deprecated**
     - **Is deprecated** can be seen as a intermediate step in the process of
       declaring a valid consent document to be invalid
     - If both checkboxes are marked, the subjects remain in the database
       and may be recruited. However, a new declaration of consent should be
       obtained as soon as possible

1.2. If only the box **Is deprecated** is ticked, the consent document is
     presumed to be invalid in general
     - If the invalidity of the document is saved, there is no longer any
       recruitment consent of subjects in the database
     This does not apply if the **Legal basis for data processing** refers to a
     **Study consent** or a **Guardianship**.
     The **Legal basis for data processing** can be viewed for each individual
     subject by following the instructions below:
     
     - Go to **Subjects** on the front page
     - Enter the first and last name of the subject and click on **Submit**
     - Go to **Details** next to the subject
     - You can see three different **Legal basis for data processing** in 
       **Overview** and which of those apply to the respective subject

2. If you wish to upload a valid and current consent document, proceed as follows:
   - Click on **Admin** on the front page
   - Go to **Consent documents**
   - Click on **Add Consent Document** (oval with grey background)
   - Choose the file you want to upload
   - Click on one of the saving options
   
Deletion of a consent document
-------------------------------
1. Click on **Admin** on the front page

2. Go to **Consent documents**

3. Choose the consent document to be deleted

4. Click on **Delete**

5. Confirm the query about whether the version should be deleted by clicking on
   **Yes, I am sure**

Maintenance of Recruitment consent
-----------------------------------
To get an overview of all subjects for whom a new **Recruitment consent** is
required, proceed as follows:

1. Click on **Subjects** on the front page

2. Go to **Maintenance** (blue button)

3. Choose the fourth tab **Consent**
   - You will see a list of all subjects with recruitment consents that are not
     current

4. Click on **Details** next to the indication **Last updated on: XY**
   - A new window will open for each subject with invalid recruitment consent

5. Go to the fourth tab **Data protection** individually
   - You will see an orange field that indicates the following text: **The
     subject has recently come of age. Please ask them to renew or withdraw
     their consent. This message will disappear once you change the value of the
     checkbox.**
     
6. Obtain a valid recruitment consent either by E-Mail, telephone or post
   - As an intermediate step, click once on the checkbox **Recruitment
     consent**. This is how you note that you are waiting for confirmation from
     the subject
     
7. If the subject agrees or withdraws his/her consent in the current consent
   document, this must be indicated
   - If the subject agrees, click on **Confirm** below **Recruitment consent**
     and **Save**
   - If the subject requests a deletion according to GDPR, click on **To be
     deleted** and save your submission