Access control of data based on purpose and/or consent

One or more non-transitory computer-readable media storing processor-executable instructions that, when executed by at least one processor, cause the at least one processor to:

• receive a request associated with an application that is executing on a client computing system and requesting access to a dataset comprising a plurality of data records handled by a storage computing system, wherein each data record of the plurality of data records comprises a plurality of data elements;
• identify, based on the application, a purpose for the application requesting access to the dataset;
• reference, based on the purpose, an applicable purpose-based access-control policy to identify an authorization token;
• and
• provide the authorization token to at least one of the client computing system or the storage computing system, wherein the storage computing system provides, based on the authorization token, the client computing system with a view of the dataset having a data element of the plurality of data elements returning modified data in a manner that is compliant with the applicable purpose-based access-control policy, wherein returning modified data in the manner that is compliant with the applicable purpose-based access-control policy comprises generating the modified data by at least one of anonymizing data returned for the data element, truncating the data returned for the data element, or obfuscating the data returned for the data element.

An apparatus comprising:

• one or more processors;
• and
• memory storing processor-executable instructions that, when executed by the one or more processors, cause the apparatus to:
• receive a request associated with an application that is executing on a client computing system and requesting access to a dataset comprising a plurality of data records handled by a storage computing system, wherein each data record of the plurality of data records comprises a plurality of data elements;
• identify, based on the application, a purpose for the application requesting access to the dataset;
• reference, based on the purpose, an applicable purpose-based access-control policy to identify an authorization token;
• and
• provide the authorization token to at least one of the client computing system or the storage computing system, wherein the storage computing system provides, based on the authorization token, the client computing system with a view of the dataset having a data element of the plurality of data elements returning modified data in a manner that is compliant with the applicable purpose-based access-control policy, wherein returning modified data in the manner that is compliant with the applicable purpose-based access-control policy comprises generating the modified data by at least one of anonymizing data returned for the data element, truncating the data returned for the data element, or obfuscating the data returned for the data element.