- LC - mailman.kantarainitiative.org

ANCR WG - The request for ISO/IEC 29184 Online privacy notice and consent to be free to access
by Mark Lizar 05 Jun '24

05 Jun '24

Dear Leadership Council, Your support of the request for ISO/IEC 29184 Online privacy notice and consent to be free to access The ANCR WG had a motion to support request for 29184 to free to access. As it is now the security and privacy controls in 29184 for notices are not available for the consent record framework in ANCR. This is why the ANCR WG motioned to support the request for 29184 to made open and to make it clear, that there is great demand, and even an urgent need for standardized digital transparency and Consent by Design. ANCR WG has identified a clear gap in trust of digital identity management driving demand for standards that enable people to manage their own digital identity and security risks. In this regard, an important request was made during the recent plenary in Manchester, UK: to make the ISO/IEC 29184 Online privacy notice and consent standard to be free to access. As our work on the Consent Receipt was specified to supplement this standard, without it bing free to access, we would not be able to directly use it. In addition, as this standard specifies transparency, it has a great value for the Consent by Design work at the ANCR WG. In fact, 29184 would provide excellent benchmarking criteria for regulators and policy makers, and with support of Kantara community we could make it possible for this consent work to fulfil its purpose of addressing misinformation in security, digital identity, AI and personal media management technology. For this purpose, on 28 May, I sought assistance from Canada’s National Mirror Committee for ISO/IEC in this effort. Below you can find a summary of my argument for doing so. Now we ask if the LC, and Kantara community will join in supporting this effort through the ISO/IEC liaison. You would not only be furthering our shared goal of enhancing digital privacy and transparency but also moving towards ensuring transparency and trust in digital identity practices worldwide. A topic in which there broad and growing consensus on, Thank you for your consideration. Mark / ANCR WG Why open access matters 29184 was developed to supplement the freely accessible ISO/IEC 29100 security and privacy techniques framework. Our work at the Kantara Initiative has long focused on standardizing notice to enable managed consent and control over data access on a large scale. This effort began more than a decade ago at the W3C - Do Not Track and Beyond conference, where Ashkan Soltani, Reuben Bins, and I presented on the need for notice and transparency standards in online security and privacy<https://www.w3.org/2012/dnt-ws/position-papers/23.pdf>. The business case for standardizing digital transparency There is a compelling business case for ISO/IEC to lead in standardizing digital transparency for security, privacy, and digital identity management. A robust set of international transparency standards would compel industries to adopt ISO/IEC’s paid security standards, such as 27001, 27002, and 27701. These standards provide specific requirements and guidance for establishing a Privacy Information Management System (PIMS). Acting now to facilitate data governance and security interoperability will enable ISO/IEC to lead this competitive practice internationally. International impact and interoperability Our commitment to this project is driven by 29100’s influence in developing international privacy instruments that are interoperable with GDPR and, importantly for Canada, the CoE Convention 108+. Expected to be ratified by 2025 latest, Convention 108+ will provide Canada with an international data governance instrument for security and privacy across the Commonwealth, encompassing 56 countries and 2.5 billion people. Convention 108+ mirrors the GDPR Chapter 1 Transparency Modalities section, and 29100 has been the only international standard we can use to create an international transparency standard that scales consent with identity management internationally. The implications for Kantara Last August, ISO/IEC 27560 Consent Record Information Structure was published, derived from the Kantara Consent Receipt V1.1 specification. This specification was designed to supplement both 29100 and 29184. When 29184 was published, the Consent Notice Receipt was included in Appendix B. Consequently, our work at Kantara on notice and consent receipts can contribute as a regulatory tool to assess the conformance and compliance of PII Controller notice records and credentials, benchmarking compliance with 29184 natively. In our ANCR WG, we developed a Transparency Performance Scheme for creating conformant PII Controller records, as a legal record of processing to assess the performance of transparency and legal validity of consent. To further this work and utilize 29184 for it to support an international standard for digital privacy transparency and consent (notice record and receipts), it, along with ISO/IEC 27560 consent record information structure must be open and freely available to use for public digital infrastructure.

1 0

Fwd: SIN 541519CSP Notice
by Kay Chopard 29 May '24

29 May '24

Hello everyone, The announcement for the new GSA SIN is out and live now. CSPs need to complete forms that can be found in idmanagement.gov, to get on the schedule. Also, please note that both state and federal government agencies are permitted to use the vendors on this schedule for credential services. So this extends Kantara-certified reach considerably. Please let me know if you have any questions. If you have thoughts about better ways to talk to companies and members about this let me know. Thanks for your support everyone. And to those of you who are CSPs - good luck! Best wishes, Kay *Kay Chopard | **Executive Director* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative On May 28, 2024, the General Services Administration (GSA) updated the Multiple Award Schedule with Refresh 21 <https://sam.gov/opp/6ed7287403a143fdaa9f3c53cc71d085/view> which contains the release of SIN 541519CSP - Credential Service Providers. Federal agencies have expressed interest in using SIN 541519CSP starting June 2024. Current MAS contract holders interested in the SIN are encouraged to contact their contracting officer for modification guidance. New offers should visit the GSA Roadmap to get a MAS contract <https://www.gsa.gov/buy-through-us/purchasing-programs/multiple-award-sched…>. The capabilities template is available on idmanagement.gov <https://www.idmanagement.gov/docs/credential-service-provider-capabilities-…>. For specific questions on the capabilities template please email icam-sin-review(a)gsa.gov.

1 0

Fwd: Establish New SIN 541519CSP - Credential Service Provider POSTING NEXT WEEK!
by Kay Chopard 22 May '24

22 May '24

Hi everyone, I got permission to be able to share this news about the GSA schedule that will be released/open next week. It's a great opportunity for Kantara and our credential services provider members. Let me know if you have any questions. Many thanks to all of you and your support for the Kantara assurance programs. Kind regards, Kay *Kay Chopard | **Executive Director* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative ---------- Forwarded message --------- From: Mcbride, Adam (OS/ASA/PSC/RLO) <Adam.Mcbride(a)psc.hhs.gov> Date: Wed, May 22, 2024 at 11:29 AM Subject: Establish New SIN 541519CSP - Credential Service Provider POSTING NEXT WEEK! Hello Everyone, I wanted to let you know the solicitation for the new GSA SIN for Credential Service Providers (CSP) will be published next week. The CSPs can respond and get on the schedule! I have attached the template that the CSPs will need to fill out and return with the needed items to the solicitation source. This is very exciting, and you can share this with anyone. Just remember it will be posted next week! Respectfully, Adam McBride HHS HSPD-12 Sr. IT Program Manager, Program Management Office Federal Lead – NextGen XMS and AMS systems Program Support Center, Real Estate, Logistics, and Operations U.S. Department of Health and Human Services 5600 Fishers Lane. Suite 2E-70 Rockville, MD 20850 P: (301) 451-1407 M: (202) 875-2514 <https://www.linkedin.com/company/program-support-center>│ psc.gov <https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.psc.gov%2f&c=E,1,5NI…> │comments <https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fsurvey.foreseeresults.c…> ****I have accepted a new position and will be leaving HHS. My last day with HHS is 31 May. If there is anything that I need to address with you prior to me leaving, please let me know. Thank you**** *From:* Mcbride, Adam (OS/ASA/PSC/RLO) *Sent:* Monday, May 13, 2024 11:16 AM *Subject:* Establish New SIN 541519CSP - Credential Service Provider Hello! Here is an extract from the Significant Changes for the GSA Multiple Award Schedule (MAS) Solicitation: iv. Establish New SIN 541519CSP - Credential Service Provider 1. Managed service offering for component or full-service Credential Service Providers (CSPs) that meet the requirements of NIST SP 800-63 Digital Identity Guidelines (current version), to include public facing and enterprise. On track for June and I just wanted to give you an update on the status of this action. Respectfully, Adam McBride HHS HSPD-12 Sr. IT Program Manager, Program Management Office Federal Lead – NextGen XMS and AMS systems Program Support Center, Real Estate, Logistics, and Operations U.S. Department of Health and Human Services 5600 Fishers Lane. Suite 2E-70 Rockville, MD 20850 P: (301) 451-1407 M: (202) 875-2514 <https://www.linkedin.com/company/program-support-center>│ psc.gov <https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.psc.gov%2f&c=E,1,5NI…> │comments <https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fsurvey.foreseeresults.c…>

3 3

Seeking testers for our new Kantara website
by Karyn Bright 16 May '24

16 May '24

Hello We have been working hard for the last few months on designing and building a new website for Kantara Initiative. The goal is to make it much easier for visitors to find information about our organization and sign up for our various services. We have created a new navigation structure and simplified page content. I believe the look and feel is much cleaner, less text heavy and generally more modern and in keeping with an organization that leads in our sector. It is now time to ask for your feedback! Please could I ask you to take some time over the coming week (our deadline is Friday 17th May) to test the new site? Please try and complete a number of tasks e.g. * sign up for membership * download an Assessor application form * download the charter and/or documents pertaining to a Work Group * highlight any British English on US pages - I am sure there will still be many examples that have crept through! I would highlight a few caveats: * The actual forms for signup are NOT active as these link to the live membership/WG database. Armin will switch these over when he moves the site off the staging server and into the live environment * We are gradually working through all the old News items to ensure consistency; not all headline/images line up properly yet HOW TO LOG ON URL: https://staging.kantarainitiative.org Username: kantaraboard Password: phvjfKgBVuBpp DETAILS FOR PROVIDING FEEDBACK Please use this spreadsheet on our shared Google Drive for recording your feedback. https://docs.google.com/spreadsheets/d/1hVr3YaLsXYj6LVBaLDew9i-95cUSvZ9h/ed… Deadline 17th May 2024 If you have any questions, please email me or post a direct message on our MatterMost channel. Thank you so much! Karyn Bright | Communications [Logo, company name Description automatically generated] Mobile: +44 (0)7931 336458 Twitter: @KantaraNews LinkedIn: @KantaraInitiative

4 5

Honoring Vittorio
by Kay Chopard 12 Apr '24

12 Apr '24

Hi everyone, I received an email today from Ian Glazer, one of the founders of the Digital Identity Advancement Foundation (DIAF). They are announcing another program honoring Vittorio Bertocci. The goal of the award is to provide grants to people to attend and participate in global technical standards events. Please circulate the announcement and information on your social media posts, through your networks, among your groups, and within your organizations. Thank you for doing this and supporting the program The information he shared with me today: LinkedIn post: https://www.linkedin.com/feed/update/urn:li:activity:7119797398243082240?up… Direct link: https://digitalidadvancement.org/awards-and-grants/vittorio/ Please let me know if you have questions or have other suggestions about disseminating this information. Karyn Bright will be sharing this on our social media as well. Thank you. Best regards, Kay *Kay Chopard | **Executive Director* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Action Required: Nano-visons for next LC Monthly (Apr 16)
by Alec L 08 Apr '24

08 Apr '24

Hi all, *The context*: Eve has been leading the board through a nano-visions exercise, and we're looking to gather input from each group for discussion on our Apr 16th Monthly call I've attached a meeting recording[1] and slides where Eve does a fantastic job explaining the whole thing (first 10mins of the recording) [1] https://drive.google.com/drive/folders/1PvDDxpj2BAJA3Giq0lComPXQlm0YhLB9 *The request*: please review the slides and first 10mins of the recording and at your next group call, please take 5-10mins to brainstorm 3-5 points: - How do your group activities overlap with these beliefs? - Can you see any gaps/possibilities to address within your group? Please reply to this thread by *Apr 6* with your group's thoughts (earlier is better!) Reply with any questions or thoughts! Best, - Alec Alec Laws CTO Engineering | IDENTOS +1 (647) 822-1529 <+1+(647)822-1529+color=> alec(a)identos.ca <https://identos.ca/> [image: twitter] <https://twitter.com/aleclaws> [image: linkedin] <https://www.linkedin.com/in/aleclaws/>

4 5

Fwd: FOR REVIEW: updated paper
by Salvatore D'Agostino 07 Apr '24

07 Apr '24

Cleaned up further Get Outlook for iOS<https://aka.ms/o0ukef> ________________________________ From: MarkL <mark(a)0pn.org> Sent: Friday, April 5, 2024 9:58:18 AM To: Tim Loyd <timl(a)transparencylab.ca> Cc: timothy Reiniger <tsreiniger(a)gmail.com>; Sharon Polsky <Sharon.polsky(a)aminacorp.ca>; Kate Tilleczek <katetill(a)edu.yorku.ca>; Paul Knowles <paul.knowles(a)meddea.global>; Salvatore D'Agostino <sal(a)idmachines.com> Subject: Fwd: FOR REVIEW: updated paper FYI - the polished version, Begin forwarded message: From: Tara Sinclair <tara.sinclair(a)reddialcomms.co.uk> Subject: FOR REVIEW: updated paper Date: 5 April 2024 at 13:15:29 BST To: Mark Lizar <mark(a)transparencylab.ca>, MarkL <mark(a)0pn.org> Incorporating your latest changes

3 5

ISO Submission
by Salvatore D'Agostino 06 Apr '24

06 Apr '24

Hi LC, Here are a combined set of comments that we are providing via Mark to ISO on their draft Age Assurance, AI Privacy, and Digital Twin working drafts and the applicability of the Transparency Performance Scheme to those standards. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com <https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

3 3

Policy for joining Work Groups
by Karyn Bright 29 Mar '24

29 Mar '24

Hello again As part of the website upgrade, we want to make it very easy for people to find the relevant information they need to participate. I have found this page which seems a useful addition to the Work Groups and GPA form https://kantara.atlassian.net/wiki/spaces/GI/pages/1089165/Joining+Groups+a… However, I note that it hasn't been updated since 2016 and there are a couple of things I feel may no longer be in policy. @Alec Laws<mailto:Alec@identos.ca> or @Kay Chopard<mailto:kay@kantarainitiative.org> Please could you advise if I am OK to use this page and, if so, any changes that should be made. Thanks Karyn Bright | Communications [Logo, company name Description automatically generated] Mobile: +44 (0)7931 336458 Twitter: @KantaraNews LinkedIn: @KantaraInitiative

3 4

Content for March Newsletter
by Karyn Bright 26 Mar '24

26 Mar '24

Hi I had hoped to listen in on your call earlier but got my time difference wrong! I am working on our March Newsletter at the moment and would love to include an update on any areas you are willing or able to highlight? AM thinking that the Deepfakes Group could do with a focus? Also @John Wunderlich<mailto:john@wunderlich.ca> - I believe you have a blog waiting in the wings? 🙂 Feel free to share it as is - I can always edit or polish it to suit the Newsletter format. @eve@xmlgrrl.com<mailto:eve@xmlgrrl.com>, if there is any sort of summary you could give me wrt the BoD work you've been leading, that would also be fab. I will listen to the transcript of the meeting later today. Appreciate your support - thanks! Karyn Bright | Communications [Logo, company name Description automatically generated] Mobile: +44 (0)7931 336458 Twitter: @KantaraNews LinkedIn: @KantaraInitiative

1 0