Why does consent get its own life-cycle process, and how does it interact with the other LCPs?

Consent (Einwilligung) to the processing of personal data is an object of its own that is given, changed and withdrawn independently of the account; because consent is the precondition for processing, the other LCPs may only process the customer's data while a valid consent exists.

In the webshop the consent is a checkbox in the self-service form. Its LCP covers:

• Create: the customer gives consent, typically at registration. To be useful as evidence, the system records what was agreed (which version of the terms), when and by whom.
• Update: the customer agrees to new terms or changes the scope of what they allow.
• Delete / withdraw: the customer withdraws consent. Under the EU GDPR (Art. 7) withdrawing must be as easy as giving it, and processing based on it has to stop from then on.

The interaction is what makes it important for modelling: if consent is a precondition, then no consent, no processing. An account LCP that creates a user, or a sync that copies data from the CRM, has to respect the consent state, and a withdrawal must trigger something downstream (stopping processing, possibly deleting or restricting data). This is the part a legal reviewer will focus on: data protection, terms and conditions, consent and deletion.

Go deeper:

• Art. 7 GDPR: Conditions for consent — proof of consent, clear wording and the right to withdraw at any time.
• Consent management (Wikipedia) — systems that record, update and withdraw consents over their life cycle.