June 2024 - Wg-ancr - mailman.kantarainitiative.org

FYI - Recently shared with me by Tim
by Mark Lizar 16 Jun '24

16 Jun '24

HI All, This would be of interest, (thanks for the share Tim) Some Consent Receipts v1.1 this one is a concept (from 2018): in which the consent receipt was not finished, but moved to ISO by some advanced digital identity management companies, First is https://www.ubisecure.com/data-protection/what-is-consent-receipt/. It does, indeed, show the data subject receiving the receipt. Here is another article on consent receipts that recognizes the value to data controllers:https://clym.io/blog/what-is-a-consent-receipt-and-why-it-matters Although neither of these enable operational consent, which the consent receipt v2 spec with the Consent by Design model, would / will address In this model, a) a Notice receipt is generated from the PII Controller credential- listed at our controller registry, via our notary API (this can be for any legal justification including consent) b) the notice receipt can then be used by the individual as a consent receipt token, with the individual (the user) sending it back to the controller to direct or manage consent. Hopefully we can get some ANCR resources to move this work forward this summer, Mark

1 0

test
by Salvatore D'Agostino 07 Jun '24

07 Jun '24

IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com <https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

Blogpost on open standards
by Salvatore D'Agostino 06 Jun '24

06 Jun '24

0 *H÷ 010 `He0 *H÷ $}Content-Type: multipart/alternative; boundary="----=_NextPart_000_01AF_01DAB810.85457480" This is a multipart message in MIME format. ------=_NextPart_000_01AF_01DAB810.85457480 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Edit - Opening the door to digital transparency - WG - ANCR - Kantara Initiative (atlassian.net) <https://kantara.atlassian.net/wiki/spaces/WA/blog/edit-v2/507183106?draftSh areId=24dd7ad3-a92c-45bd-b095-1bfc8cede605> Based on call yesterday. So this is a wg draft, at this point please review and provide comments here to start. This is a revamp, reset of process for blog posts. Propose blog on topic by WG Create draft on wiki Review in WG Publish on wiki In this case I will also give the LC a heads up at the leadership meeting on Tuesday as well given the . As a widely distributed blog it would be better if we had Kantara backing for the ask to make this group of standards open.. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com <https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender. ------=_NextPart_000_01AF_01DAB810.85457480 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><META = HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 = (filtered medium)"><style></style></head><body lang=3DEN-US = link=3D"#467886" vlink=3D"#96607D" style=3D'word-wrap:break-word'><div = class=3DWordSection1><a = href=3D"https://kantara.atlassian.net/wiki/spaces/WA/blog/edit-v2/5071831= 06?draftShareId=3D24dd7ad3-a92c-45bd-b095-1bfc8cede605">Edit - Opening = the door to digital transparency - WG - ANCR - Kantara Initiative = (atlassian.net)</a><o:p></o:p><o:p> </o:p>Based on = call yesterday.<o:p></o:p><o:p> </o:p>So this is a = wg draft, at this point please review and provide comments here to = start.<o:p></o:p><o:p> </o:p>This is a revamp, reset of process for blog = posts… <o:p></o:p><o:p> </o:p>Propose blog on topic by WG<o:p></o:p>Create draft on wiki<o:p></o:p>Review in WG<o:p></o:p>Publish on wiki<o:p></o:p><o:p> </o:p>In this case = I will also give the LC a heads up at the leadership meeting on Tuesday = as well given the … <o:p></o:p><o:p> </o:p>As a widely = distributed blog it would be better if we had Kantara backing for the = ask to make this group of standards open..<o:p></o:p><o:p> </o:p>Best,<o:p></o:p>Sal<o:p></o:p><o:p> </o:p>IDmachines<o:p></o:p></span= >4 Lamson = Place<o:p></o:p>Cambridge, MA = 02139-2612<o:p></o:p>+1 = 617.201.4809<o:p></o:p>@idmachines<o:p></o:p></spa= n><a = href=3D"https://idmachines.com/">https://idmachines.com</a><o:p></o:p></s= pan><o:p> </o:p>Please note our new = address. Email, phones, other contacts remain the = same.<o:p></o:p><o:p> </o:p>Disclaimer<o:p></o:p>The information contained in this communication from the sender is = confidential. It is intended solely for use by the recipient and others = authorized to receive it. If you are not the recipient, you are hereby = notified that any disclosure, copying, distribution or taking action in = relation of the contents of this information is strictly prohibited and = may be unlawful. If you have received this email in error, please delete = it and advise the sender.<o:p></o:p></= span><o:p> </o:p><o:p> </o:p></div></body></html> ------=_NextPart_000_01AF_01DAB810.85457480-- ü0`0H BE#ÈDµ0 *H÷ 0J10 UUS10U IdenTrust1'0%UIdenTrust Commercial Root CA 10 140116181223Z 340116181223Z0J10 UUS10U IdenTrust1'0%UIdenTrust Commercial Root CA 10"0 *H÷ 0 §PÞ?=Ô3FñoQa²©Og]ÙSÝ(Ù×ðÿ®Crùµ]|ÁBá1PtÑ |Í!«Câ¬^nó Z2œ¢ëùè\ ìÿÒ¯q³ŽSNïŒœìO20K^WÄSÂöÙb+¿$bßÃž)KIx<`"üÚ6ÈÂ¢Ô,Tg5ns¿Xð€Ýå°¢&zÊà6¥õý·ï®?@õmZýÎ4Ê$Üt#]3]Ä%ö0Ý]àÕGœŽë¡»IIØ[óä$äbOOÁ¯tšÑrjzIÌŽFyÆ±ÚYúu!eÝVÎû«¥`ÄùR°œù+# #v;÷3áÉóiùK¢àNŒ~9÷Dp~þZå±¬ÑÌò5åIIÊVÉ=û};ÁÂMÉO7é¡jßb.Ë5Qy,È%8ôúK§\Òã 9Jt|ÕYÂ?N\Rô=÷Rñê£¬ýI4(óA:îèÞÿ_ºËèò¹P`À1ÓsåïŸ í3tŸ ÄglðzUFN§ô>áöØ á3d+c×2^ùÀ{xoŒùxz×rtUtx±ºánpºO ºhÃ{ÿ1ðs==*±A þMeky3Ž×£B0@0Uÿ0Uÿ0ÿ0UíDÀÓðî€{ŸBç&TÈ6v0 *H÷ ®2öŠK|Dva'(Í^Tï%Œãù)×®háXï..~SR¶\êºP×ßa æÎÁò7x°_³¢sž8Í>°žûÀÏ±òì--Ììª³ª`-;Ã=WužÓ0Í`ÓTñMfÀ]t@£î~ÂwèÁ§]RíÉÝ%mú©í£:4ÐY{ÚíPó5¿íëM1Ç`ôÚñâHâÆÅ7ûúuYf1G)Úvé®ï¹Q÷#ib<åU6×Tÿñ¹]ÎÔ#oØEJ[eïÝ§ Ë¥%Ž ùð¢ÒôÈt¡*HeÛÄâ%}ëŸ[ TQJSì]Ê3íbýEÇ/[ÜX 9æú×þŠí=JBtÔÃwYsÍFŸU8ïúè2êX"Þ8ÃÌŒmÉ3:j i? Èêrc#œm<àILª¢¹*6xíÃèFâ&YDuÙuQÍa`Ë]ù"Mæãö[»®ÍÊJk^óQát+é~'§ÙINø¥Û%cbÉ3gk<ÆÞšÍð7qò«üAõÁì7] åNïú±\8¥JáÜ8-<Ü«ÕJîÑplÌîôWøºn00 @žáê<zÌ>BO0 *H÷ 0:10 UUS10U IdenTrust10UTrustID CA A140 240425192606Z 260426192506Z0M1!0 *H÷ sal(a)idmachines.com1(0&UA01410C0000018F16B8E1DC00130CBB0"0 *H÷ 0 êPV_FŒÞÇYÞ»1w@ ÿÈÈr/näœ»uoBŠZ@^üÈ »wýVá!ó}gk° >:¥4:ütÅe"°³XÉº&XºðpÓ²>ºEÍ?z ¬b^5á¯ôRiÓïVOgLaèÕ².úrÑF~ÃöÕ?ô5,ËÅú2¯áâœú"EÆšŽ5õ4Åk~CP*ÒfnTnhÄÈ*£}ÞIºÝ€VÛÄTÞÄEh\8ºº ù]BÊÑÈQi1¢/vNþŠÆk'5²;6ÿËènë®0 |=£00Uÿ00Uÿ 0+x0v00+0$http://commercial.ocsp.identrust.com0B+…U#0ÂÔD qÏHVŸh8\§·÷EŒ0#U 00 g0 `Hù/0EU>0<0: 8 64http://validation.identrust.com/crl/trustidcaa14.crl0U0sal(a)idmachines.com0U6(Óqï/ØD@Ø;lmXæSE~0U%0 +0 *H÷ °`ó0Äùê2`'3V-ŠÔý.ÛvéñNF$~L/2A2õþèC(á£Ãüûdï\×î ;!)GùÓ¬NÍÏÐÖ®êòrš¥%]TaË#ÑQ÷²Ö/ªÆÛä$]IÙNØCÓ*Yµ°ôHàî+ÈŠå£ªaóòœyJl[RU*wœZºé%¹v9N6¬N}íà³so4=µ#Ü)}MÅQWãQüÊoHÖþÿ©ðMoÃŠÌ^ªê,®j³± Li;I)¡Øâ&È:÷€ôÿÕç<fëñA±°ßÙm°x~š-Çu<Îý>>U±5íkªmÀÇÏë|Ô`îMEa³©)&sGriûi=Ñïfhµîuø$ÐqÃ 6ÅÆ<A<šÄÞAr7À¢dŒÀ£0ŠbZÍ»ÄÏž.î£ú§Bì)! Ûª¬Éã#jÕäbßúätâV\1èÑÄN ÓÝÝ ^ÐGÜ]šb¹ÜÞFûn}Ácô2ŽÅ]OÝ 1ö)ÉË ."La\W!!ìRj[Ø@ðÒ{ìKÆ+ÜZ3Ù%¯Áf{"ÀË7WF¯\¬1vyÓŽÄ0ô0Ü @ÿÒiÚwÂéÕMM0 *H÷ 0J10 UUS10U IdenTrust1'0%UIdenTrust Commercial Root CA 10 230816192846Z 330812192845Z0:10 UUS10U IdenTrust10UTrustID CA A140"0 *H÷ 0 è©õŒ±éäÙËíX€ËF`eð¬ûÃA`kX»0DÙ9bÜrÁñRñÕ×«²3È÷6u/!²Öa§? Œ§8lxn×î%ûf¬<²Ñ»X$=-Ÿà§ÆÍ£EðiùëžÅFÖ{ePH»òÒßqEK tG%£¹yP2`A6ìL[Nä\ÍÒ§»Ó À[:«CQR ãL|70ídj¢Et«¹}Ì u÷@ òxb× Æ°K=°1dªØØWÐ.ïvkª r Xý(bšFr|qG Ôñ³ÿ£|\3òÚtÈ:ÒXTßŒôBp`¡Â`@±[xoÄR^.W°ö@ÁÃé7¯Ì;Œ=Us¯Ø$YÂîníºË*tÅùÛò\ oþåê'Y. xp,¬\¿åù!³I.EÛË7ï¢±ßÔh[P:4£ÿ]|×2`vZXtZ+cÒŒ~ÚÖP!!4Ó3aózG]wËí=.DÜ"X¯jë]êq?å§â!»aææVBJFQCj)(ñ" êÀÈ"©&?žR§gßû--Ùùt=µK7w¬eÀ#×k%ã3Ö)ŠÁåwsšxh:ÂÝ 8Ÿmí&Û5®i"\OŽEÝ£ä0à0Uÿ0ÿ0Uÿ0+}0{00+0$http://commercial.ocsp.identrust.com0G+0;http://validation.identrust.com/roots/commercialrootca1.p7c0U#0íDÀÓðî€{ŸBç&TÈ6v0_U X0V0TU 0L0J+>https://secure.identrust.com/certificates/policy/ts/index.html0JUC0A0? = ;9http://validation.identrust.com/crl/commercialrootca1.crl0UÂÔD qÏHVŸh8\§·÷EŒ0AU%:08++ +7 +7 +7 0 *H÷ ò][i]ãR®hÝE#+ 9q7%,Lya`VRÐÛ|ìAs«ÊœkYPÄÜdw S_ÇS¡Šá°èö(1Ü@ žæŒ&tš-B9Ì§åÚTt³Ý¿xQ¿0_¬óã°lÏ>Çc@±]NDì[£]ùb9"fkj¬ØçÀÉ¬Å»µû]5O®šªJ}ø@/Sä":MÄ ¥ÜIpÎ-'- WÌ»/MNÎŸaŒ@,µtí ¿ÛøÎxÒ]ªK'Eh2»ëô¬EØÍìÁjìñK³Ô g£JGÌüž«b]aÕ6ì·»m>Ë¡Ér"HA)ãÔ®r"Dë$\4Áìwš"0ØëQ%DœÐgëZÏ]\×¹IŽ¶l#@0â èÜ;£_àº,÷íèjA=UéOÆ0üôÈÖAg!Y6 ô*s!YTÉŒ¿é©J^íxàÝN}ý+Š°L%Rmü?â/[ìs$ßÃÿeZ((ôjdÓ±x*EB;2SšDåêìÄXyÈÍÏ3ké/ÒysáÎZªf²žÍ~º£±}EÐ*)K]b8NU¢f1<080N0:10 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0 `He ¿0 *H÷ 1 *H÷ 0 *H÷ 1 240606165325Z0/ *H÷ 1" ÎO^eÄ ºáLdydaq6_/Þ°^â¢30] +71P0N0:10 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0_*H÷ 1P N0:10 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0 *H÷ 100 `He*0 `He0 *H÷ 0 `He0*H÷ 0 *H÷ @0 `He0 `He0 `He0+0 *H÷ ëR!éûÃÐ§tæò4jdµ)ØP#[%Hí/œíáSÁçò²¥&| TÇëÕÏÇì)L,åÚØ·Å·û©+[kÖpÊäTŠõÿ£Ý³Ñ%qfJ]ýú9Õ|Â®Ôš»[NA)ýÀä¬ 8Ce¢8¢è®?Ú:&Öc§päÊË>ësÇËcguóé)»PNüAµd0,/ªèícªL)Fuxotn©TÒwÅÞÈÅyþÜ±JÈïl¢ šî|/åÙSQË DzÂÌ0/t?;Tõa÷ÂH#š¹

1 0

ANCR WG - The request for ISO/IEC 29184 Online privacy notice and consent to be free to access
by Mark Lizar 05 Jun '24

05 Jun '24

Dear Leadership Council, Your support of the request for ISO/IEC 29184 Online privacy notice and consent to be free to access The ANCR WG had a motion to support request for 29184 to free to access. As it is now the security and privacy controls in 29184 for notices are not available for the consent record framework in ANCR. This is why the ANCR WG motioned to support the request for 29184 to made open and to make it clear, that there is great demand, and even an urgent need for standardized digital transparency and Consent by Design. ANCR WG has identified a clear gap in trust of digital identity management driving demand for standards that enable people to manage their own digital identity and security risks. In this regard, an important request was made during the recent plenary in Manchester, UK: to make the ISO/IEC 29184 Online privacy notice and consent standard to be free to access. As our work on the Consent Receipt was specified to supplement this standard, without it bing free to access, we would not be able to directly use it. In addition, as this standard specifies transparency, it has a great value for the Consent by Design work at the ANCR WG. In fact, 29184 would provide excellent benchmarking criteria for regulators and policy makers, and with support of Kantara community we could make it possible for this consent work to fulfil its purpose of addressing misinformation in security, digital identity, AI and personal media management technology. For this purpose, on 28 May, I sought assistance from Canada’s National Mirror Committee for ISO/IEC in this effort. Below you can find a summary of my argument for doing so. Now we ask if the LC, and Kantara community will join in supporting this effort through the ISO/IEC liaison. You would not only be furthering our shared goal of enhancing digital privacy and transparency but also moving towards ensuring transparency and trust in digital identity practices worldwide. A topic in which there broad and growing consensus on, Thank you for your consideration. Mark / ANCR WG Why open access matters 29184 was developed to supplement the freely accessible ISO/IEC 29100 security and privacy techniques framework. Our work at the Kantara Initiative has long focused on standardizing notice to enable managed consent and control over data access on a large scale. This effort began more than a decade ago at the W3C - Do Not Track and Beyond conference, where Ashkan Soltani, Reuben Bins, and I presented on the need for notice and transparency standards in online security and privacy<https://www.w3.org/2012/dnt-ws/position-papers/23.pdf>. The business case for standardizing digital transparency There is a compelling business case for ISO/IEC to lead in standardizing digital transparency for security, privacy, and digital identity management. A robust set of international transparency standards would compel industries to adopt ISO/IEC’s paid security standards, such as 27001, 27002, and 27701. These standards provide specific requirements and guidance for establishing a Privacy Information Management System (PIMS). Acting now to facilitate data governance and security interoperability will enable ISO/IEC to lead this competitive practice internationally. International impact and interoperability Our commitment to this project is driven by 29100’s influence in developing international privacy instruments that are interoperable with GDPR and, importantly for Canada, the CoE Convention 108+. Expected to be ratified by 2025 latest, Convention 108+ will provide Canada with an international data governance instrument for security and privacy across the Commonwealth, encompassing 56 countries and 2.5 billion people. Convention 108+ mirrors the GDPR Chapter 1 Transparency Modalities section, and 29100 has been the only international standard we can use to create an international transparency standard that scales consent with identity management internationally. The implications for Kantara Last August, ISO/IEC 27560 Consent Record Information Structure was published, derived from the Kantara Consent Receipt V1.1 specification. This specification was designed to supplement both 29100 and 29184. When 29184 was published, the Consent Notice Receipt was included in Appendix B. Consequently, our work at Kantara on notice and consent receipts can contribute as a regulatory tool to assess the conformance and compliance of PII Controller notice records and credentials, benchmarking compliance with 29184 natively. In our ANCR WG, we developed a Transparency Performance Scheme for creating conformant PII Controller records, as a legal record of processing to assess the performance of transparency and legal validity of consent. To further this work and utilize 29184 for it to support an international standard for digital privacy transparency and consent (notice record and receipts), it, along with ISO/IEC 27560 consent record information structure must be open and freely available to use for public digital infrastructure.

1 0

Request for 29184 to be made free to access submitted
by Mark Lizar 03 Jun '24

03 Jun '24

Hi ANCR’s, I have just submitted this request to ISO/IEC Mirror Committee, here is the requests - (without the form) for your review, and perhaps with ANCR Consensus on this topic ANCR WG can support this too? What do you think @Sal? Kind Regards, Mark **** Dear JTC1 / SC 27 / WG5 Mirror Committee, During the plenary in Manchester UK a request to make ISO/IEC 29184 Online privacy notice and consent standard free to access. First and foremost this is a transparency standard for online privacy notice which if not open defeats the purpose of the standard, which can be used to address mis-information in security and digital identity management technology. 29184 was made to supplement the free to access ISO/IEC 29100 security and privacy techniques framework and it has been a long term focus of the work at the Kantara Initiative, with the mission of standardizing notice to enable consent to managed control and access to data scale online. This effort began in 2012 with a call to action for notice and transparency standards for security and privacy online at a W3C - Do Not Track and Beyond conference, where Ashkan Soltani, Reuben Bins and I presented on this topic<https://www.w3.org/2012/dnt-ws/position-papers/23.pdf>. There is a clear business case for ISO/IEC to standardize digital transparency for security, privacy and digital identity management, as a successful international transparency set of standards would more aggressively onboard industries into ISO/IEC paid security standards. 27001, 27002, and 27701 which provides specific requirements and implementation guidance for establishing a Privacy Information Management System (PIMS). Enabling data governance and security interoperability is competive practice which ISO/IEC obviously wants to lead internationally in. The reason we chose this project and work was because ISO/IEC 29100 has driven the development of international privacy instruments, and is interoperable with GDPR and more importantly for Canada, CoE Convention 108+ which is expected to be ratified in 2024 or 2025. Providing Canada with an international data governance instrument for security and privacy across the commonwealth containing 56 countries and 2.5 Billion people. Convention 108+ mirrors the GDPR Chapter 1 Transparency Modalities section and ISO/IEC 29100, as a free to access standard, has been the only international standard which we can use to make an international transparency standard to scale consent with identity management internationally. . Background The standard published last August, ISO/IEC 27560 consent record information structure, was developed from the Kantara Consent Receipt V1.1 specification, which was written to supplement both 29100 and 29184 Online privacy notice and consent standard. When 29184 was published the Consent notice receipt, was published in the Appendix B, and as a result, our notice and consent receipt work at Kantara could be contribute as a regulatory tool to asses conformance and compliance of PII Controller notice records and credentials, which could then be used to benchmark compliance with 29184 natively. In the ANCR WG we have a Transparency performance scheme, for making conformant records of processing and for assessing if consent is valid or not. In order to further this work or to utilize 29184 to support an international standard for digital privacy transparency and consent (aka notice record and receipts) it must be open and freely available to be use and specify with. To this end, I humbly ask for this committees's support of this request to make ISO/IEC 29184 Online privacy notice and consent standard open and free to access . Best Regards, Mark Lizar

2 7