This rapport describes our effort to develop and implement the agreement portal, a GDPR compliant consent collection and management system. The General Data Protection Regulation (GDPR) is a regulation imposed on member states by the European Union. It encompasses data that can be used in a process to identify a private person, and is thus not limited to data that by itself is descriptive enough to be considered "personal information". This definition implies that usage patterns not directly linked to identity can be considered applicable to GDPR.
To act in accordance with this new regulation, Agderposten asked us to build a Consent Management Platform in unison with their in-house developers. This management system ensures that Agderposten has the rights to act upon customers data by presenting users with a UI that asks them for consent to use various data and to process it. Even though the definition of these "agreements" was out of scope for this project, a good example of such an agreement would be: "We ask you for consent to use your email to send you marketing campaigns not related to your subscription".

To clear the way for this project, we accepted an extension of scope in the form of a security fix that was essential to implement the CMP. This additional fix materialised as a microservice for Agderposten customer service to reset passwords of users and change their email in a secure manner.
The project is utterly critical for the contracting entity, Agderposten, as this system will run in production and provide coverage for their customers. The portal has materialised in cooperation with the in-house developers. We have been both challenged and surprised along the way, mainly because the project finds itself in the middle of a crossroads between technology and law.