May 2024 - Wg-ancr - mailman.kantarainitiative.org

ANCR WG call reminder
by Salvatore D'Agostino 12 Nov '24

12 Nov '24

Dear ANCR WG, We have a very active plate of WG activities to complete by year end. Also Thanksgiving tomorrow here. Proposed Agenda Roll IPR Approve Agenda (5 min) Administration (30 mins, 10 per topic) Charter Refresh https://github.com/KantaraInitiative/WG-ANCR/blob/main/ANCR-Charter-Update-2 023.md Officer Nominations and Election Board Funding Request Technical Editor GitHub organization and administration Translation (French specifically) (Scope and Budget for above) Digital Commons White Paper (10 min). Digital Transparency Performance Scheme https://github.com/KantaraInitiative/WG-ANCR/blob/main/TPI/ANCR-Digital-Tran saprency-Scheme-v0.9.1.pdf (10 min). AOB IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

2 1

Request for 29184 to be made free to access submitted
by Mark Lizar 03 Jun '24

03 Jun '24

Hi ANCR’s, I have just submitted this request to ISO/IEC Mirror Committee, here is the requests - (without the form) for your review, and perhaps with ANCR Consensus on this topic ANCR WG can support this too? What do you think @Sal? Kind Regards, Mark **** Dear JTC1 / SC 27 / WG5 Mirror Committee, During the plenary in Manchester UK a request to make ISO/IEC 29184 Online privacy notice and consent standard free to access. First and foremost this is a transparency standard for online privacy notice which if not open defeats the purpose of the standard, which can be used to address mis-information in security and digital identity management technology. 29184 was made to supplement the free to access ISO/IEC 29100 security and privacy techniques framework and it has been a long term focus of the work at the Kantara Initiative, with the mission of standardizing notice to enable consent to managed control and access to data scale online. This effort began in 2012 with a call to action for notice and transparency standards for security and privacy online at a W3C - Do Not Track and Beyond conference, where Ashkan Soltani, Reuben Bins and I presented on this topic<https://www.w3.org/2012/dnt-ws/position-papers/23.pdf>. There is a clear business case for ISO/IEC to standardize digital transparency for security, privacy and digital identity management, as a successful international transparency set of standards would more aggressively onboard industries into ISO/IEC paid security standards. 27001, 27002, and 27701 which provides specific requirements and implementation guidance for establishing a Privacy Information Management System (PIMS). Enabling data governance and security interoperability is competive practice which ISO/IEC obviously wants to lead internationally in. The reason we chose this project and work was because ISO/IEC 29100 has driven the development of international privacy instruments, and is interoperable with GDPR and more importantly for Canada, CoE Convention 108+ which is expected to be ratified in 2024 or 2025. Providing Canada with an international data governance instrument for security and privacy across the commonwealth containing 56 countries and 2.5 Billion people. Convention 108+ mirrors the GDPR Chapter 1 Transparency Modalities section and ISO/IEC 29100, as a free to access standard, has been the only international standard which we can use to make an international transparency standard to scale consent with identity management internationally. . Background The standard published last August, ISO/IEC 27560 consent record information structure, was developed from the Kantara Consent Receipt V1.1 specification, which was written to supplement both 29100 and 29184 Online privacy notice and consent standard. When 29184 was published the Consent notice receipt, was published in the Appendix B, and as a result, our notice and consent receipt work at Kantara could be contribute as a regulatory tool to asses conformance and compliance of PII Controller notice records and credentials, which could then be used to benchmark compliance with 29184 natively. In the ANCR WG we have a Transparency performance scheme, for making conformant records of processing and for assessing if consent is valid or not. In order to further this work or to utilize 29184 to support an international standard for digital privacy transparency and consent (aka notice record and receipts) it must be open and freely available to be use and specify with. To this end, I humbly ask for this committees's support of this request to make ISO/IEC 29184 Online privacy notice and consent standard open and free to access . Best Regards, Mark Lizar

2 7

Reminder: 0PN-ANCR Call tomorrow
by Mark Lizar 28 May '24

28 May '24

A reminder that we have a 0PN - ANCR Call tomorrow, Besides a list of things to do, the aim is to also discuss the Transparency Index Service to Demo the ANCR specifications, and to use the TPS Scheme to show the state of valid consent in digital identity systems. Does anyone object to using the same zoom # but for 0PN Trust Framework Call tomorrow? Mark

1 0

ANCR Blog - With New Video Link & Blog - Re: Vimeo link from April 11, Manchester
by Mark Lizar 26 May '24

26 May '24

Hi All, (thanks Tim and Tara) It took a bit of working on compressing the video. Hopefully not too much. I had to install compression software, compress the video, and then on the 3rd attempt, I had to verify with google to upload a vid longer than 15 min, (Arg. This means sending my ph to the USA with my profile so I can be ‘verified') Finally, these have been added in the ANCR Blogs; one on Consent by Design with Standard Digital Privacy Transparency on the ANCR Wiki<https://kantara.atlassian.net/wiki/x/eQAvHQ>. As well as the first report to JTC 1 Committee<https://kantara.atlassian.net/wiki/x/lgAvHQ>. Next report to them is on Addressing ethics and governance in generative AI with Standardized Digital Privacy Transparency, and then a request to them for making ISO/IEC 29184 Online privacy notice and consent open and free to access. The ANCR TPS Scheme could then be used to benchmark compliance (not just conformance) against this standard. All feedback is welcome of course, (thanks for that so far Sal) I will give it another edit and polish Mark <https://youtu.be/QrJnFJFuv3g> youtu.be<https://youtu.be/QrJnFJFuv3g> [X]<https://youtu.be/QrJnFJFuv3g>

1 0

ANCR Blog & ISO Committee Report - Re: Report Author / Editors needed
by Mark Lizar 25 May '24

25 May '24

Hi Sal, (Everyone) ( I am moving this great thread to ANCR WG mailing list) The ANCR Post Digital Transparency for Consent by Design<https://kantara.atlassian.net/wiki/pages/resumedraft.action?draftId=4896195…> is now up on ANCR - with what feels like a very strong consensus. The report to ISO Committee Report<https://kantara.atlassian.net/wiki/pages/resumedraft.action?draftId=4896196…> (and Transparency Index Project Overview<https://kantara.atlassian.net/wiki/pages/resumedraft.action?draftId=4896196…>) is now moved to Kantara Wiki, but from what I can tell only Sal and Gigi are signed up to Kantara Wiki, so I have been able to give you both (Sal and Gigi) access. Marcelle, Dan, Tim, Tara, Gaz, Tregon, Shankar et al, you would need to subscribe<https://kantarainitiative.org/mailman/listinfo/wg-ancr> to this wiki (it’s free) if you would like to see what is restricted from public view and work on the Transparency Index with us. Happy Jedi Privacy Day, Mark (commemorating the day GDPR was implemented in the EU) PS Sal - Again, I am not 100% sure which doc you are referring too, On May 25, 2024, at 9:48 AM, Salvatore D'Agostino <sal(a)idmachines.com> wrote: Can we start with why instead of what? Who is the audience? Why this matters to them?

1 0

Updates & The Digital Transparency Blog
by Mark Lizar 22 May '24

22 May '24

Hi All, We had a tremendously productive call today, first we have in formally agreed to add specifying the ANCR Consensus Protocol and processes as a core activity and piece of work will do on the calls, in addition to receiving and discussing updates, and maintaining the work group admin and roadmap. Proposing that we work on Consensus protocol each bi-weekly call focusing on terms of process in a specification document, and then we try working with and on the consensus protocol via GitHub. With this clarity of the ANCR work and purpose really starts to come into focus. It’s my tasks to get things going in this regard, with an action for the initial docs by next meeting. The first point of consensus we are looking to drive and comment on is the first blog post <https://kantara.atlassian.net/wiki/pages/resumedraft.action?draftId=4810670…> (due Tomorrow) and then the list of short blog posts which is in the ANCR - Kantara Github. <https://github.com/KantaraInitiative/WG-ANCR/discussions/21#discussion-6713…> Please review and comment on these two items in order to drive my editing and content delivery. @Sal, please start from here - / continue from here with the slide for Kay (as actioned on the call) Kind Regards, Mark

1 0

Plurality: The Future of Collaborative Technology and Democracy
by Salvatore D'Agostino 21 May '24

21 May '24

https://www.plurality.net/ Get Outlook for iOS<https://aka.ms/o0ukef>

2 1

Re: Event Updated: DPVCG Meeting Call 15 May 2024
by Mark Lizar 16 May '24

16 May '24

Hi Iain, Thats great idea. We are and have been working on this for years, and have the consent receipt v2, with consent token specification. Essentially, the piece I would really enjoy working out / discussing with this group is finishing purpose specification for the 6 legal justifications, as the purposes defined somewhat by this. In addition, 3 to 4 years ago, I presented the types of consent, mapped to legal justification and the rights to this group. But at this time it was not considered by DPV. Whats even more interesting now is that we have the approach of Consent by Design, which is effectively about digital transparency for security and privacy interoperability (or digital privacy for short) which requires a receipt and record, just like in banking. In consent by design - all the notice, notification and disclosures are specified semantically to be from the consent, a protocol we are calling AuthC - which is authentication from consent. It doesnt matter what the legal justification is, the transparency modality and semantics are always human centric and from the capture of real consent. In this regard, its is the notice and the action of the individual ands the context that defines the purpose. In this way consent is captured, as long as it complies with transparency modalities. To which we have identified 23 transparency notice, notification and disclosure requirements in the GPDR which are required depending on the legal justification. The Kantara Transparency Performance Scheme<https://kantara.atlassian.net/wiki/x/O4P5EQ> is what is used to assess whether or not the consent is legally valid. The way it works is really simple. The PII Controller record <https://kantara.atlassian.net/wiki/spaces/WA/pages/312378386/ANCR+0PN-TFP+-…> (not consent record) is linked to any notice or sign with the Signalling icon, (AKA the consent gateway for privacy as expected) the notice and the semantics are specified using ISO/IEC 29100 and the DPV, the PII Principle clicks on the I accept button, and the controller credential is used to generate a notice record and consent/notice receipt, which provides legal proof of notice, aka proof of knowledge. The reason we call it a consent receipt is that this receipt can then be used to direct consent for a secondary purpose, regardless of the legal justification, independent of the provider. This has immense benefits in multiple ways especially for data governance, it is the Law in Quebec Canada. Just like receipts working currency banking, works the same for knowledge banking. It’s getting really fun now, after addressing some these really puzzling challenges that have stumped us in the past. Happy to contribute this to and support this work I. DPV Best, Mark On May 16, 2024, at 2:46 AM, Iain Henderson <iain(a)jlinc.com> wrote: Hi Mark, I see where you are coming from and agree. This issue has been noted previously, and I have taken the action to come up with a proposed ‘human’ extension for DPV that introduces that lens that is oriented for a reader / user of DPV (or an agent acting on their behalf) to have a framing of specific that works for them. Happy to have you contribute that if you think that works? Cheers Iain On 16 May 2024, at 06:14, Mark Lizar <mark(a)openconsent.com> wrote: Simply put, Consent is provisioned from the individual — it’s from a person - the semantics must reflect this. While the standard might say consent record, in reality it is a record of notice, which provides proof of knowledge that give the legal evidence of consent. So ‘obtain consent<https://github.com/w3c/dpv/issues/115#issuecomment-1793416931>’ is not correct semantic as this would be obtain permission, The trouble with enterprise type of legal perspective is that the semantics are all interpreted from the institutional perspective in DPV, while consent in law is acutally human legal perspective. This means consent comes from people, it’s not a something is too someone - e.g. obtained from them. It could be ‘provided’ or it could be captured, indicated through action, but only if is informed in accordance with Chapter 1 Transparency Modalities in GDPR. Does this help? Mark On May 15, 2024, at 10:05 AM, Harshvardhan Pandit <me(a)harshp.com> wrote: Hi Mark. I have the same understanding - and I am not disagreeing with you - but I don't understand what you're asking here (sorry). What do you - specifically - want to add or change or remove from DPV? DPVCG does not make requirements for how things work - we provide a specification for representation of information for requirements that come from e.g. law or standards. On 15/05/2024 14:54, Mark Lizar wrote: Hi Harsh, Consent is human and legally defined, and this is how it is defined in law. Both must be considered. Systems manage permissions, human manage consent, and consent is implied through the purpose of an action. Most importantly, consent can only be provided if there is sufficient transparency, it is not something that happens independent of notice. For consent to be valid, the identity of the controller must first be provided, or else consent cannot be provided. - Mark On 15 May 2024, at 09:26, Harshvardhan Pandit <me(a)harshp.com> wrote: Hi Mark. We are modelling consent as defined in laws and legal terminology. From the perspective of the individual, they 'provide' consent. From the perspective of the organisation, they 'obtain' (or collect) consent. I don't think we are conflating consent and permissions. On 15/05/2024 14:22, Mark Lizar wrote: Hi All, There is a huge issue in that Consent and Permission are very confused. Systems obtain permission, permission is given, all of which can happen with out the consent or consensus of the individual. The semantics are incredibly important, as the dark patterns in the identity management is a significant problem. Best, Mark On 15 May 2024, at 09:05, Mark Lizar <mark(a)openconsent.com> wrote: Hi Harsh, Consent is provided not obtained, On 14 May 2024, at 16:10, Harshvardhan J. Pandit (W3C Calendar) <noreply+calendar(a)w3.org> wrote: View this event in your browser <https://www.w3.org/events/meetings/0f0fbb7f-df36-4325-b39b-60e0eac5c8b7/202…<https://www.w3.org/events/meetings/0f0fbb7f-df36-4325-b39b-60e0eac5c8b7/202…>> DPVCG Meeting Call 15 May 2024 ^Upcoming ^Confirmed 15 May 2024, 14:00 -15:00 Europe/Dublin Event is recurring weekly on Wednesday, starting from 2024-04-24, until 2024-12-19 Data Privacy Vocabularies and Controls Community Group <https://www.w3.org/groups/cg/dpvcg/calendar/<https://www.w3.org/groups/cg/dpvcg/calendar/>> This is the weekly DPVCG meeting call Agenda Agenda <https://www.w3.org/events/meetings/0f0fbb7f-df36-4325-b39b-60e0eac5c8b7/202…<https://www.w3.org/events/meetings/0f0fbb7f-df36-4325-b39b-60e0eac5c8b7/202…>> Previous minutes:https://w3id.org/dpv/meetings/meeting-2024-05-08<https://w3id.org/dpv/meetings/meeting-2024-05-08><https://w3id.org/dpv/meetings/meeting-2024-05-08<https://w3id.org/dpv/meetings/meeting-2024-05-08>> This meeting will be chaired by Beatriz with apologies from Harsh To confirm issue can be closed: (the text will be updated after concepts are finalised) * justifications:https://github.com/w3c/dpv/issues/83<https://github.com/w3c/dpv/issues/83> <https://github.com/w3c/dpv/issues/83<https://github.com/w3c/dpv/issues/83>> see live: https://harshp.com/dpv/justifications/<https://harshp.com/dpv/justifications/> <https://harshp.com/dpv/justifications/<https://harshp.com/dpv/justifications/>> * statuses for involved, intention, entity informed: https://github.com/w3c/dpv/issues/116<https://github.com/w3c/dpv/issues/116> <https://github.com/w3c/dpv/issues/116<https://github.com/w3c/dpv/issues/116>> see live: * human involvement and automatino: https://github.com/w3c/dpv/issues/108<https://github.com/w3c/dpv/issues/108> <https://github.com/w3c/dpv/issues/108<https://github.com/w3c/dpv/issues/108>> see live: https://harshp.com/dpv/dpv/#vocab-context-status<https://harshp.com/dpv/dpv/#vocab-context-status> <https://harshp.com/dpv/dpv/#vocab-context-status<https://harshp.com/dpv/dpv/#vocab-context-status>> * Tech extension - dropped prefix 'Technology' from actors: https://github.com/w3c/dpv/issues/142<https://github.com/w3c/dpv/issues/142> <https://github.com/w3c/dpv/issues/142<https://github.com/w3c/dpv/issues/142>> * Tech extension - added cloud concepts, status, docs, removed categories:https://github.com/w3c/dpv/issues/47<https://github.com/w3c/dpv/issues/47> <https://github.com/w3c/dpv/issues/47<https://github.com/w3c/dpv/issues/47>> * AI Act add Prospective Provider: https://github.com/w3c/dpv/issues/146<https://github.com/w3c/dpv/issues/146> <https://github.com/w3c/dpv/issues/146<https://github.com/w3c/dpv/issues/146>> * added GDPR principles, see live: https://harshp.com/dpv/legal/eu/gdpr/#vocab-principles<https://harshp.com/dpv/legal/eu/gdpr/#vocab-principles> <https://harshp.com/dpv/legal/eu/gdpr/#vocab-principles<https://harshp.com/dpv/legal/eu/gdpr/#vocab-principles>> (fyi, confirm its okay) To discuss: * measures for consent obtain, withdraw etc.: https://github.com/w3c/dpv/issues/115<https://github.com/w3c/dpv/issues/115> <https://github.com/w3c/dpv/issues/115<https://github.com/w3c/dpv/issues/115>> - added controls for consent, see live: https://harshp.com/dpv/dpv/#vocab-legal-basis-consent-controls<https://harshp.com/dpv/dpv/#vocab-legal-basis-consent-controls> <https://harshp.com/dpv/dpv/#vocab-legal-basis-consent-controls<https://harshp.com/dpv/dpv/#vocab-legal-basis-consent-controls>> * Express 'goal' or 'purpose' of technology - https://github.com/w3c/dpv/issues/85<https://github.com/w3c/dpv/issues/85> <https://github.com/w3c/dpv/issues/85<https://github.com/w3c/dpv/issues/85>>, see https://lists.w3.org/Archives/Public/public-dpvcg/2024May/0002.html<https://lists.w3.org/Archives/Public/public-dpvcg/2024May/0002.html><https://lists.w3.org/Archives/Public/public-dpvcg/2024May/0002.html<https://lists.w3.org/Archives/Public/public-dpvcg/2024May/0002.html>> proposing tech:hasIntendedUse Reminder: * DPV v2 release schedulehttps://github.com/w3c/dpv/milestone/4<https://github.com/w3c/dpv/milestone/4> <https://github.com/w3c/dpv/milestone/4<https://github.com/w3c/dpv/milestone/4>> Help wanted: * update README.md and docs -https://github.com/w3c/dpv/issues/144<https://github.com/w3c/dpv/issues/144> <https://github.com/w3c/dpv/issues/144<https://github.com/w3c/dpv/issues/144>> * add profile metadata to dpv rdf - https://github.com/w3c/dpv/issues/141<https://github.com/w3c/dpv/issues/141> <https://github.com/w3c/dpv/issues/141<https://github.com/w3c/dpv/issues/141>> * review contents (when ready) - https://github.com/w3c/dpv/issues/127<https://github.com/w3c/dpv/issues/127> <https://github.com/w3c/dpv/issues/127<https://github.com/w3c/dpv/issues/127>> AOB Joining Instructions Join the meeting <https://dcu-ie.zoom.us/j/92216714069?pwd=NUIrZWFmWDF0bExhU3V2ak43L3lrUT09 <https://dcu-ie.zoom.us/j/92216714069?pwd=NUIrZWFmWDF0bExhU3V2ak43L3lrUT09>> Participants Groups * Data Privacy Vocabularies and Controls Community Group <https://www.w3.org/groups/cg/dpvcg/<https://www.w3.org/groups/cg/dpvcg/>> (View Calendar <https://www.w3.org/groups/cg/dpvcg/calendar/<https://www.w3.org/groups/cg/dpvcg/calendar/>>) Report feedback and issues on GitHub <https://github.com/w3c/calendar<https://github.com/w3c/calendar>>. To stop receiving these emails please update your calendar preferences <https://www.w3.org/users/myprofile/calendar/preferences/<https://www.w3.org/users/myprofile/calendar/preferences/>>. <event.ics> -- --- Harshvardhan J. Pandit, Ph.D Assistant Professor ADAPT Centre, Dublin City University https://harshp.com/<https://harshp.com/> -- --- Harshvardhan J. Pandit, Ph.D Assistant Professor ADAPT Centre, Dublin City University https://harshp.com/

1 0

Reminder - 0PN -ANCR - Call Today
by Mark Lizar 15 May '24

15 May '24

Hi All, A reminder that we are staring the 0PN-ANCR call today (every second wed) using the same call details, Mark Lizar Executive Director. 0PN; Digital Transparency Lab * Toronto +1 -289 - 501 -3597 * London +44 208 -123 2476

1 0

ANCR Roadmap and Assurance Program WG proposal
by Mark Lizar 01 May '24

01 May '24

HI ANCR WG, On today’s call we proposed that every second Wed meeting now be focused on the development of the ANCR Scheme and its use for a Kantara International Registrar Assurance Program. With the scope to have an initial set of meetings, aka CG, which would then propose the larger program (ideally for consideration in September). Here is a link to the workgroup proposal, drafted by Sal and I posted here for comment and review, <https://kantara.atlassian.net/wiki/x/FAAXGw> PII Controller Conformance Assessment: ANCR WG Development - WG - ANCR - Kantara Initiative<https://kantara.atlassian.net/wiki/x/FAAXGw> kantara.atlassian.net<https://kantara.atlassian.net/wiki/x/FAAXGw> [favicon-update.ico]<https://kantara.atlassian.net/wiki/x/FAAXGw> Next week, we will discuss this for consensus, and vote, which means we will cover comments and the results of their review if necessary, before a vote (if we are quorate), next Wed meeting, This proposes a transition of working group structures and mandates intended to accelerate the awareness and adoption of digital transparency (for privacy and consent) using ANCR standards for distributing and decentralising authority and governance online. Looking forward to your feedback Kind Regards, Mark Lizar Executive Director President Digital Transparency Lab and 0PN Digital Commons * Toronto +1 -289 - 501 -3597 * London +44 208 -123 2476

1 0