Ongoing consent

ChurchSuite's Ongoing Consent feature can help simplify the process of obtaining consent for those in the Address Book and Children modules, helping you comply with the UK Data Protection Act 2018 and EU General Data Protection Regulation 2018 (GDPR).

Overview of the consent workflow

The use of the My Consent functionality in this article is independent of using the member-facing My ChurchSuite and does not require your organisation or members to be using My ChurchSuite to send consent requests. The best compliance with the GDPR is when data subjects can manage their data, which is what My ChurchSuite is primarily designed for. Without access to My ChurchSuite data subjects will only be able to manage their data when they receive a consent request (explained in this article) or when submitting their personal information as a newcomer using the My Details form running at your Information Point through Connect, or when using the Address Book Embed. Therefore we encourage you to make My ChurchSuite available to those in your ChurchSuite database for best compliance - and to reduce some of the office administration when data subjects can manage their personal information.

You can send consent requests to individuals, groupings of people (perhaps in a Tag) or all contacts and children if you wish. This can be done from a contact's profile in the Address Book, a child's profile in the Children module, or the Communication section of the respective module.

Embedded in the consent request email is a personal link to the recipient's own My Consent form. The My Consent form lists all the personal data you hold for that person displayed in a partially-obfuscated (starred out) format. Internal-use 'legitimate interest' data like notes, key dates, tags and flows are not shown in the form although you will likely need to explain this type of processing in your organisation's privacy notice.

Contacts and their children can then easily review their personal information on the My Consent form - making corrections, adding missing information, or removing data they no longer wish you to process. They can also review their Privacy Settings (if My ChurchSuite access is enabled) and their Communication Options, before finally ticking the checkbox to confirm they accept your privacy notice and submit the completed form; or, they can request that their account be deleted from your ChurchSuite account. Your privacy notice should make the process clear for those invoking their right to be forgotten, but remember that the right to be forgotten is not the same as a request for their data to be deleted from ChurchSuite (this is further explained in the related support article).

Where the consent form response is submitted (and consent is given) any changes made on the form by the data subject are updated on their profile in ChurchSuite, with a change log added. A helpful 'Ongoing Consent' Key Date is added against the person's profile, and as a double consent confirmation, the data subject receives a Success email that includes a snapshot of the My Consent form they submitted. The sent success email is added to the person's Communication log and serves as further evidence of consent.

If a consent request recipient selects Delete account, an email is sent to your organisation's designated Data Protection contact (set in Administrator > Profile) so that you can follow your preferred internal pastoral and administrative workflows for removing data held on ChurchSuite - unless you have an overriding lawful basis for continuing to process some or all of their personal information. The 'delete account' request will never auto-delete a person - this can only be actioned by a User after review and due consideration of the request.

The process for requesting consent from adult contacts and children is identical. Each data subject will receive a separate personalised consent request email and each individual has their own My Consent form. As part of the ChurchSuite consent form submission workflow the data subject is required to type their name (like a digital signature); meaning that you will know whether the My Consent form was completed by the data subject or by a spouse/partner or a parent/carer on behalf of their child. Do remember that children over the age of consent (13+ years under the EU GDPR) may be able to provide their consent or a parent/carer with parental responsibility may consent on the child's behalf. The name of the My Consent form's submitter is included in the 'consent' Key Date that is added, along with the date/time of consent, the IP address of the submitter and the consent method (i.e. the "My Consent" form, as opposed to a paper-based consent perhaps recorded by one of your Users). Where your organisation has multiple consent-gathering admin workflows - perhaps a paper-based system for those who don't have an email address - you may wish to make use of the Ongoing Consent key date for those processes too - in this way a single 'Ongoing Consent' key date instance will help you determine those that have or have not yet provided you with ongoing consent.

Where consent is your lawful basis for processing, for best compliance, and certainly when your organisation's processing purposes change, you can send an ongoing consent request form again at any time.

Adding your privacy notice

Before sending consent requests, make sure your organisation's privacy notice is up to date and added to ChurchSuite. Your privacy notice is made available on all public-facing forms where people will submit personal data including the My Consent form. Remember, a data subject cannot be deemed to have fairly consented if your privacy notice was not available at the time they responded to your consent request for the ongoing processing of their personal information.

Your privacy notice is added in the Administrator section of your ChurchSuite account, within the Profile area - see the related support article How to customise the appearance of your ChurchSuite account, which includes step-by-step instructions.

Customising the My Consent form

Before sending consent requests, take time to work through and review the settings to customise the form your data subjects will access.

First, be aware that the My Consent form uses the same field settings as My ChurchSuite - fields editable in My ChurchSuite are also editable on the My Consent form; similarly, fields that are not editable in My ChurchSuite will not be editable on the My Consent form. Since best compliance with the GDPR is when a data subject can manage all their personal data, you should review the My ChurchSuite Options for the Address Book and Children modules so that any optional Fields that you use to collect personal data are editable in My ChurchSuite and on the My Consent form too.

Of course, any internal-use custom fields can be set as not visible in My ChurchSuite, or you may wish to set them as visible, but not editable. A good example may be an internal-use "membership status" custom field that you set visible in My ChurchSuite, but you probably don't want this editable! Best compliance is to be as transparent as possible about the personal data you hold, perhaps by setting custom fields visible, even though the data subject cannot change the data - in this way mistakes or incorrect data can more easily be identified and rectified (the "right to rectify" is also a data subject's right under the GDPR). See the related support on Adding custom fields for people for further information about custom field visibility and editability in My ChurchSuite and My Consent.

Next, head to the Profile section of the Administrator area, and click on the My ChurchSuite settings section...

Scroll down the page to the Communication and Privacy sections and review the information that will be displayed in these respective sections on the My Consent form - click Edit to make changes. The same messages are shown for contacts, parents/carers and children, so you should use language and terminology that is clear and easy for your audience to understand what their communication and privacy settings mean.

Still in the Administrator Profile, click on the My Consent tab. This tab contains the remaining settings that control the appearance of the My Consent that data subjects will complete.

Working through each section in turn click Edit to add your own content. Begin by customising the consent form Title and the [Welcome] Message that shows in the form's Header.

Optionally customise the consent form's Footer message and the Success message people will see on the screen when they submit their completed form. You can also choose a Success Email by first creating a Preset email (in Administrator > Presets). ChurchSuite will append a snapshot of the submitted My Consent form to the selected preset success email. If no preset success email is created, ChurchSuite will send the form snapshot as a standalone confirmation email. The 'From' address in the ChurchSuite-generated email will be your organisation's designated Data Protection contact (set in Administrator > Profile) but if you choose a Preset success email, you can specify the 'From' address in the preset's settings.

The Footer Message is shown like this on the My Consent form.

The Success Message displays on the screen when people submit the completed form.

Customising the consent request email

The ongoing consent process begins by sending people a Consent Request email. There are two Preset emails - one for Address Book contacts and one for children in the Children module that will be sent to a parent/carer and/or child. You can customise both preset emails to ensure the language and terminology best suit your context. Make sure that the language used within the child consent request email is clear and easy for them to understand, otherwise, your consent request may not be deemed compliant!

Head into the Administrator area of ChurchSuite and click the Presets section. For each consent request preset - Consent Request and Consent Request (Child) - select Edit from the preset Actions.

You can further customise the content of the Preset email. The Review & grant consent link must be present in the email body. The link wording itself can be customised, but the underlying ::my_consent_link:: merge field must be left intact and present - it's this merge field that becomes each recipient's My Consent form link when the preset is sent to each data subject.

Bulk-sending consent requests to multiple people

The process of bulk-sending Consent Requests is the same for contacts and children. For children, you will have the option to send the request to the child's primary parent/carers, to all the child's parents/carers, or the child.

Head into the respective Address Book or Children module's Communication section and select the contacts or children you want to send the consent request email to. Note the option to Search by individual contacts/children or those grouped in Tags. Selected contacts or children move from the list on the left to the box on the right.

Next, locate the Consent box at the bottom of the page and click Send consent requests.

The Consent Request is previewed before sending, along with a list of recipients. Click Send email to complete the process.

Note: Consent requests are always sent, even if a recipient has opted out of receiving general emails in the communication options - consent isn't needed to send a consent request!

Sending individual consent requests

You can send individual Consent Requests directly from a contact or child's profile page in the respective Address Book or Children module. Select Send consent request option from the Communicate drop-down.

Note: Consent requests are sent even if a recipient's communication options are opted out of receiving general emails - you do not need consent to send a consent request!

Managing ongoing consent for those without an email address

The ::my_consent_link:: merge field present in the Consent Request preset email (explained above) can also be used in an SMS message, meaning that you can send consent requests by SMS, perhaps for those who don't have an email address but who do have a mobile number.

And for contacts and children where neither an email address nor mobile is held, you might consider using the Full Details report to produce a printed summary of each person's personal data that can then be posted to the individual, perhaps in duplicate with a covering letter and your privacy notice, asking them to review and return one copy signed and dated and indicating any changes and their consent.

The Full Details report is located in the Data Cleansing section of the respective Address Book and Children module reports sections...

You can identify people without email addresses and mobile numbers using a Smart Tag, perhaps with conditions as follows (which matches people with a missing email address and a missing mobile telephone number)...

...and then use that Smart Tag to filter the Full Details report for just those without email addresses and mobiles.

You can use the same Smart Tag to produce address labels for envelopes (in Communication > Labels/Envelopes). Notice also the option to Log in Communication, enabling you to record the sending of a consent request by post in the Communication log of each person you produce a label for.

As each manually-sent consent form is returned you can add an 'Ongoing Consent' key date against the person...

You might also scan and upload paper consent forms to a secure online file storage solution like Dropbox, iCloud or GoogleDocs, and then add a link to the scanned consent form file as a Note against the person's profile.

And finally, in this section, you may find it helpful to set an Ongoing Consent key date to be added automatically when newcomers submit their details using the Address Book Embed and Connect My Details forms. Head into the Address Book and Children module settings via the cogwheels icon in the top-right corner of the respective module.

Scroll down the Connect Options tab to the Add contact/child section. Click Edit and select the Ongoing Consent key date to be assigned when a new contact or child's details are submitted into the module through the My Details form.

Scroll down the Embed Options tab to the Add contact/child section. Click Edit and select the Ongoing Consent key date to be assigned when a new contact or child's details are submitted into the module through the Address Book Embed form.

Managing ongoing consent received and outstanding

It's helpful to distinguish where there are outstanding consent requests; especially if your processing purposes change and you need to reach out to those in your database to request updated ongoing consent. For those who complete and submit the My Consent form, several things happen in ChurchSuite that will help you keep on top of 'granted' and 'outstanding' consents.

1. An 'Ongoing Consent' Key Date is added to the person's profile.

2. When a person completes and submits their My Consent form a record of the data subject's confirmation email is added to their Communication log. The confirmation includes a snapshot of the consent form at the date/time of submission and serves both as evidence of the consent given and also a double check for the data subject i.e. they too will have a record of the data they consented to.

3. Any changes to personal information made on the My Consent form are recorded in each person's Changes log.

With these things in mind and if you are using the workflows outlined in this article, you can use the presence or absence of the 'Ongoing Consent' Key Date to easily identify people whose consent is granted, outstanding, or due to update. For example, the following Smart Tag condition matches people who have consented in the last 3 years...

A variation of the above tag can be inverted to identify missing consent or those whose consent was given more than 3 years ago.

By having both of the above Smart Tags in place in your Address Book and Children modules, each contact or child profile page will clearly show their latest consent status.

The Key Dates report and Key Dates Missing report can be filtered for the 'Ongoing Consent' key date to quickly identify those who have consented and those whose consent is outstanding or missing. You can also communicate directly from the report's results, perhaps to send a reminder to those whose consent is outstanding.