The period of time under which data has been gathered is the dominant vector used in Privacy policy today.

It is possibly not clear what the meaning of Consent.except.period is. My understanding is that this is a constraining element to identify data that this exception applies to. Where the constraint is relative to the date/time for which the data was gathered. That is the period identifies a start and stop timeframe within which any data gathered in that period is considered controlled by this exception. This seems a proper use of the data type Period.

Presuming this is the proper understanding, the question comes up what is the formal definition of 'gathered'? Or is there some other term we should use. Is it formally the "Create" time of the Resoure? What about revisions of the Resource? If it is revisions, then this might enable a threat to privacy if the resource is ever revised? This revision, surely is an authorized revision, but it might have unintended conceqences relative to privacy constraints.

Complicating this is the many dates associated with <any> resource. That resource might have dates within the resource. That resource hasa Resorce.meta.lastUpdated. That resource might have a Provenance resource pointing at it.

For example, the Consent.data.period is often used to blind an episode of care that the patient wants forgotten. Such as an abortion, possibly blinding it only to parents or spouse. This blinding would fail if the records were revised (e.g. to correct a mistake).

Solution:

Fixing the meaning to 'gathered' or 'created'; explicitly excluding period underwich the object was revised.

Or where the resource has an element or Provenance that indicates date gathered; that is to be used.