- Wg-ancr - mailman.kantarainitiative.org

latest version of document
by Salvatore D'Agostino 07 May '25

07 May '25

Hi WG, Here is the latest version of the document. We have finished the comment period. The tracked changes are suggestions, mostly from me, though the title change was something Mark and I crafted at the end of the call today. I would like to get consensus on these changes and... At this point there is really only the terms and definitions and new title to address. Can you all please review these and if you have any suggestions on either of these items can you please provide those comments here on this thread, and if you like mirror those in the Signal channel. For example on page 12 after the call today we reduced the new terms to the following two: PII Controller Identification The process of identifying a controller of Personally Identifiable Information (PII) through the disclosure of key details, including their physical address, contact information, and a designated privacy access point, in order to ensure transparency regarding the applicable policy jurisdiction and the legal authority governing the processing of personal data. PII Controller Identification Record A record created with the information provided in the process of PII Controller Identification. So.. if you want to comment on these definitions please do so. I don't believe we have an need to introduce any other new terms, but am willing to listen if someone wants to make the case, and feel free to do so here. By working in this manner we can move ahead independently of meetings and calls and use those to confirm the work being done asynchronously. I would be happy to get a return copy of the attached document from anyone who want to use this to make track changes, as there is still a decent chance that some things may have been missed. I think this is easier than trying to do this via the wiki. Alternatively and likely more easily I have loaded this as a Google doc https://docs.google.com/document/d/1pgTVyGCRuKuWhSAJUMINKuGbwIRyjC7__vitOqQ… And happy to share that with anyone that wants to put in comments or suggest edits in that way. Thanks for your continued support of the work. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

ANCR WG call reminder - tomorrow 23rd, April / 1.00pm EST
by Gigi Agassini 06 May '25

06 May '25

Dear ANCR WG. This is a friendly reminder about our meeting scheduled for tomorrow at 1:00 PM EST. Agenda: Please find the agenda here: Agenda Link<https://kantara.atlassian.net/wiki/x/DQBYOg> Call Link: Join the Meeting<https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09> I look forward to seeing you all tomorrow. Kindest Regards, Gigi Agassini

1 1

reminder TPR review call
by Salvatore D'Agostino 30 Apr '25

30 Apr '25

On now.. https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

test
by Salvatore D'Agostino 29 Apr '25

29 Apr '25

IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

Minutes - meeting April 23rd
by Gigi Agassini 26 Apr '25

26 Apr '25

Dear ANCR WG Thank you for attending our meeting on Wednesday, April 23rd. Please find the link to the minutes, which include the key actions and discussions we covered: Meeting Minutes<https://kantara.atlassian.net/wiki/x/DQBYOg> If you notice anything missing or have any questions, please don’t hesitate to reach out. Additionally, please mark your calendars for our next Working Session on Wednesday, April 30th at 1:00 PM EST. The meeting link remains the same. Meeting Link<https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09> Looking forward to seeing you all there! Kindest Regards, Gigi Agassini

1 0

TPI-R Spec, Semantic Opportunity for nnovation
by Mark Lizar 23 Apr '25

23 Apr '25

Some Notes, Wrt to today’s call, we decided to continue next week, finishing up the spec while we likely await a barrage of last minute inputs, and we havent even discussed the idea of extending the deadline. (Common practice ;-) Today, we actually accomplished work on terms, draft list now here <https://kantara.atlassian.net/wiki/x/EQDTNw> We also decided to be specific to scope of legal terms, and notice obligations that are specified legally, in particular those with regards to permission to be identified. (Of using a cookie) To this point, I invite everyone to interpret - Quebec Law 25, wherein, it references in 8.1 (quoted below) and see if there is a missing control we can add ? "any person who collects personal information from the person concerned using technology that includes functions allowing the person concerned to be identified,located or profiled must first inform the person (1) of the use of such technology; and (2) of the means available to activate the functions that allow a person to be identified, located or profiled.” The complaint for the TPR focuses online identified, (not location or profiling) and the law here indicates a control that is not opt-in, but turn on. Does this resemble an online control ? (An example would be nice) While the current T&C environment is opt-out, as it is mainly US Service based, -could this be a - turn on - identification, button? Would this also be. Notice record (in our spec), a ROPA in the EU, and a consent receipt? Best, Mark

1 0

Fw: Public Comment to the Joint Committee on Advancing Information Technology, the Internet and Cybersecurity
by Salvatore D'Agostino 22 Apr '25

22 Apr '25

________________________________ From: Salvatore D'Agostino Sent: Monday, April 14, 2025 4:56 PM To: Tricia.Farley-Bouvier(a)mahouse.gov <Tricia.Farley-Bouvier(a)mahouse.gov>; Michael.Moore(a)masenate.gov <Michael.Moore(a)masenate.gov> Cc: Daniel Schleifer <dan(a)idmachines.com>; gigi.agassini(a)gmail.com <gigi.agassini(a)gmail.com> Subject: Public Comment to the Joint Committee on Advancing Information Technology, the Internet and Cybersecurity Joint Committee on Advanced Information Technology, the Internet and Cybersecurity Chairs, Thank you for the opportunity to comment on the legislation under consideration. The ability of security and privacy professionals to apply their skills for good are greatly enhanced by the power of law. Too often security measures and privacy compliance are put in place only as a reaction to something gone wrong. The comprehensive slate of legislation here empowers better design and operation of data processing systems, and associated products and services by organizations and citizens. Massachusetts and the United States have, in the past, led the way in terms of privacy rights and frameworks. The Fair Information Practice Principles (FIPPs<https://www.fpc.gov/resources/fipps/>) that are adopted into the ISO/IEC 29100:2024<https://www.iso.org/standard/85938.html> Privacy framework from 50 years ago still apply today. It is good to see Massachusetts come back into the fight with other states across the country in enacting substantial legislation. The Kantara Initiative, where I chair a workgroup<https://kantarainitiative.org/work-groups/ancr/> on Anchored Notice and Consent Receipt, recently published for public comment a set of transparency performance indicators that can be used to measure whether there is a valid basis for consent. This legislation provides the ability to add further to legal requirements that help to define consent. S45 and H78 for example have excellent language around the requirements for consent. What exists today in too many cases are the dark patterns referenced in the legislation, provides a light to expose and change them. In the work we do we reference laws and frameworks to create security and privacy technology for people, this legislation helps. At IDmachines, we believe that there is a great opportunity for innovation when it comes to privacy and security for people. We believe this can be done in a way that benefits all stakeholders, and provide a better data economy, and that we can do that in Massachusetts. In addition to the legislation we need privacy and security infrastructure for people. While that may seem like a big dig, it in fact can be done with a fraction of the investment and provide tremendous benefits to the Commonwealth its citizens and beyond. We can create an alternative to surveillance valley that provides more useful, secure, and private digital, and real world identity, access, and mobility. The establishment of a public registry for 3rd party collecting entities could be expanded to all PII Controllers, including all covered entities in the legislation. It could include all that operate in the state of MA. It would provide sufficient information so that people could understand who they are dealing with, as could a program operating on their behalf, as to whether their status as a covered entity was in good standing, in effect the availability of a certificate of good standing, and in the case of where they are not registered in the Commonwealth, the same from the jurisdiction of their registration. In the past, I had the honor to serve as the Chair and President of the Identity Ecosystem Steering Group, a public-private partnership in cooperation with the National Institute of Standards and Technology. We published and stood up an initial registry<https://idefregistry.edufoundation.kantarainitiative.org/>. There now exists an significant opportunity, even perhaps more than before. The attached recommendation gives an example of the information that could be aggregated into controller records in that registry. It would better enable direct digital interactions between people and organizations. It is possible to go beyond managing data brokers to enabling dynamic direct data, business, and personal exchanges and reduce the need and impact of things in the middle. Respectfully, Salvatore D’Agostino IDmachines LLC 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

2 1

ANCR WG Minutes and Reminder for ANCR WG working session tomorrow
by Gigi Agassini 15 Apr '25

15 Apr '25

Dear ANCR WG. Thank you for attending Wednesday 9th's meeting. Please find the link to the minutes, which include the actions and discussions we covered: https://kantara.atlassian.net/wiki/x/MIBROQ If you notice anything missing or have any questions, please don't hesitate to reach out. This is a reminder for our ANCR WG Working session tomorrow Wednesday, April 16th at 1.00pm EST. meeting link: https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 Best regards, Gigi Agassini

1 0

FW: NEW | Privacy Framework 1.1 Initial Public Draft Release
by Salvatore D'Agostino 14 Apr '25

14 Apr '25

From: NIST Cybersecurity and Privacy Program <csrc.nist(a)service.govdelivery.com> Sent: Monday, April 14, 2025 3:07 PM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: NEW | Privacy Framework 1.1 Initial Public Draft Release <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/04/248…> View As Web Page<https://links-1.govdelivery.com/CL0/https:%2F%2Fcontent.govdelivery.com%2Fa…> <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/09/280…> NIST Cybersecurity and Privacy Program NEW | Privacy Framework 1.1 Initial Public Draft Release NIST is pleased to announce the release of the Privacy Framework 1.1 Initial Public Draft (IPD)<https://links-1.govdelivery.com/CL0/https:%2F%2Fdoi.org%2F10.6028%2FNIST.CS…>! The NIST Privacy Framework is a “living” tool meant to evolve to meet stakeholder needs, and the time has come to update to Version 1.1. This update builds on the success of Privacy Framework 1.0 by responding to current privacy risk management needs, realigning with NIST Cybersecurity Framework (CSF) 2.0, and enhancing usability. The following resources are included with the Privacy Framework 1.1 IPD release: * Privacy Framework 1.1 IPD Highlights video<https://links-1.govdelivery.com/CL0/https:%2F%2Fvimeo.com%2F1075421918%2F57…> that summarizes the development process and reviews key updates. * Mapping of Privacy Framework 1.0 Core to Privacy Framework 1.1 Core<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nist.gov%2Fdocument%2Fp…> to help organizations trace changes to Core Categories and Subcategories between Framework versions. NIST welcomes stakeholder feedback on the Privacy Framework 1.1 IPD by June 13, 2025. For more information, including a comment template and instructions for submitting feedback, please click the button below. To receive periodic updates and hear about other opportunities to engage, subscribe to our Privacy Engineering mailing list<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…>. If you have questions, please contact us at privacyframework(a)nist.gov<mailto:privacyframework@nist.gov>. Read More<https://links-1.govdelivery.com/CL0/https:%2F%2Fcsrc.nist.gov%2Fpubs%2Fcswp…> NIST Cybersecurity and Privacy Program Questions/Comments about this notice: privacyframework(a)nist.gov<mailto:privacyframework@nist.gov> Connect with us <https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.facebook.com%2FNIST/1/0…><https://links-1.govdelivery.com/CL0/https:%2F%2Ftwitter.com%2FNIST/1/010001…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.youtube.com%2FNIST/1/01…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.linkedin.com%2Fcompany%…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.instagram.com%2Fnist%2F…> Received this email from a friend? Subscribe here<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…>. <https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nist.gov%2Fitl/1/010001…> Subscriber services: Manage Preferences<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Unsubscribe<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Help<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…> _____ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…>. Technical questions? Contact inquiries(a)nist.gov<mailto:inquiries@nist.gov>. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 <https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.granicus.com…> <https://links-1.govdelivery.com/CI1/0100019635b28839-3eb0c0d8-62b7-4ac6-a21…>

1 0

Pirvacy Activity in MA
by Salvatore D'Agostino 14 Apr '25

14 Apr '25

Hi WG, There are written comments due today. I am review this fairly comprehensive set of legislation, and will share my comments with the list. I can submit these as IDmachines and mention the WG, I can also put the WG name on comments. I will try to get these out by noon. Hearing Details - Joint Committee on Advanced Information Technology, the Internet and Cybersecurity<https://malegislature.gov/Events/Hearings/Detail/5114> Also please let me know about the general WG slides. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0