- Wg-ancr - mailman.kantarainitiative.org

TPI LC Vote
by Salvatore D'Agostino 05 Jun '25

05 Jun '25

Hi WG, The TPI document has been approved by the LC! It will go out for all member ballot next week. Thanks for all your work and support. Almost there. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

No call today
by Salvatore D'Agostino 04 Jun '25

04 Jun '25

We are taking a break as the TPIs move thorough approval See you I two weeks Best Sal Get Outlook for iOS<https://aka.ms/o0ukef>

1 0

FYO. No Meetings this month
by Mark Lizar 04 Jun '25

04 Jun '25

Hi ANCR WG, Identiverse + summer = Holidays - no meetings this month We are looking fwd to the ANCR TPI Report. Review and publishing Until then — good bleedy jo everyone, the TPI - Report for Valid Consent could be a game changer !!! Lets see

1 0

Fwd: [EXTENDED DEADLINE: 2nd CfP] 2nd NeXt-Generation Data Governance workshop @ SEMANTiCS 2025 – NXDG 2025
by Mark Lizar 23 May '25

23 May '25

FYI > Begin forwarded message: > > From: Beatriz Gonçalves Crisóstomo Esteves <Beatriz.Esteves(a)UGent.be> > Subject: [EXTENDED DEADLINE: 2nd CfP] 2nd NeXt-Generation Data Governance workshop @ SEMANTiCS 2025 – NXDG 2025 > Date: 22 May 2025 at 04:37:02 GMT-4 > To: "public-solid" <public-solid(a)w3.org> > Resent-From: public-solid(a)w3.org > Reply-To: Beatriz Gonçalves Crisóstomo Esteves <Beatriz.Esteves(a)UGent.be> > > Please circulate within your networks. Apologies for multiple postings. > ==== > 2nd NeXt-Generation Data Governance workshop @ SEMANTiCS 2025 – NXDG 2025 > Vienna, Austria > September 3–5, 2025 > https://w3id.org/nxdg/2025 > ==== > > Deadline for paper submission: July 04, 2025 (11:59 pm, AoE) > > The NeXt-generation Data Governance 2025 workshop aims to bring together technical, legal and societal researchers, and industry experts to discuss data governance, emergence of data spaces and the impact of the European strategy for data in such systems. The workshop aims to support the development of solutions to manage data, policies and provenance in a trustful and interoperable manner and to aid in the management and reporting of legal documentation falling from the EU’s GDPR for data protection and the DGA, Data Act, AI Act and EHDS to create legally-aligned, AI-powered data ecosystems, using semantic-based specifications such as ODRL, DPV or Solid. > > As such, this workshop will have presentations and discussions of interest to both data providers and consumers, researchers, standardisation bodies, businesses, and citizens who want to interoperate in the Data Spaces era. > > The workshop will accept two types of contributions: > Full papers must be at least 8 and at most 16 pages of main content, with additional pages for references. > Short/demo papers must be at least 5 and at most 7 pages of main content, with additional pages for references. > > = Important Dates = > – Paper Submissions: July 04, 2025 (11:59 pm, AoE) > – Acceptance Notifications: July 23, 2025 (11:59 pm, AoE) > – Conference Date: September 3–5, 2025 > > = Topics of Interest = > Broadly, we welcome submissions on any of the following topics: semantics and interoperability, AI & data governance, regulations, data protection, privacy, policy management and enforcement. A non-exhaustive list of suggested topics is below: > Role of the Semantic Web in the European strategy for data > FAIR management and interoperability of data spaces > Management of data altruism / intermediation services activities > Legal and governance aspects of data spaces > Legal and governance aspects of IoT data management > Legal and governance aspects of AI models and AI-generated data > Policies for access and usage control > Policy management and enforcement in data spaces > Going beyond consent for personal data processing > Data spaces and secondary reuse of data > Reasoning over data and data policies > Negotiation of access to data through Web agents > Personalisation of data management interfaces > Usability of data management interfaces > Digital identity and data wallets > User-centric perspectives on privacy and data protection > Decentralisation and personal data spaces > Personal knowledge graphs > Standards for personal data management > Standards for AI-based systems > Auditing methods/tools for data spaces > > = Author Guidelines and Submission = > For Submission Guidelines please head to the online call for papers: > https://w3id.org/nxdg/2025 > Contributions will be reviewed in an open manner with OpenReview. Submission link: https://openreview.net/group?id=SEMANTiCS.cc/2025/Workshop/NXDG > > We are looking forward to your contribution! > > Beatriz Esteves, Harshvardhan J. Pandit, Ruben Verborgh > NXDG 2025 Organisers

1 0

ANCR WG call reminder - tomorrow 23rd, April / 1.00pm EST
by Gigi Agassini 21 May '25

21 May '25

Dear ANCR WG. This is a friendly reminder about our meeting scheduled for tomorrow at 1:00 PM EST. Agenda: Please find the agenda here: Agenda Link<https://kantara.atlassian.net/wiki/x/DQBYOg> Call Link: Join the Meeting<https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09> I look forward to seeing you all tomorrow. Kindest Regards, Gigi Agassini

1 2

Fw: [KI-LC] Leadership Council Meeting Notice - May 20, 2025
by Salvatore D'Agostino 16 May '25

16 May '25

Tuesday LC call Get Outlook for iOS<https://aka.ms/o0ukef> ________________________________ From: Amanda Gay <amanda(a)kantarainitiative.org> Sent: Friday, May 16, 2025 1:01 PM To: lc(a)kantarainitiative.org <lc(a)kantarainitiative.org> Subject: [KI-LC] Leadership Council Meeting Notice - May 20, 2025 Hi all: The Leadership Council will meet next Tuesday, May 20, 2025 at 10 AM ET. Zoom info below: https://us06web.zoom.us/j/94897867446?pwd=YSsxdjZLMzFmUmhNd2NBMnlwbEZHZz09<https://www.google.com/url?q=https://us06web.zoom.us/j/94897867446?pwd%3DYS…> A draft agenda<https://kantara.atlassian.net/wiki/spaces/LC/pages/1009451009/2025-05-20+LC…> is located on the Wiki. We look forward to seeing everyone! Best, -Amanda -- Amanda Gay | Work Groups and Membership [Logo, company name Description automatically generated] Phone: +1 571-475-8895 LinkedIn: @KantaraInitiative

1 0

latest version of document
by Salvatore D'Agostino 13 May '25

13 May '25

Hi WG, Here is the latest version of the document. We have finished the comment period. The tracked changes are suggestions, mostly from me, though the title change was something Mark and I crafted at the end of the call today. I would like to get consensus on these changes and... At this point there is really only the terms and definitions and new title to address. Can you all please review these and if you have any suggestions on either of these items can you please provide those comments here on this thread, and if you like mirror those in the Signal channel. For example on page 12 after the call today we reduced the new terms to the following two: PII Controller Identification The process of identifying a controller of Personally Identifiable Information (PII) through the disclosure of key details, including their physical address, contact information, and a designated privacy access point, in order to ensure transparency regarding the applicable policy jurisdiction and the legal authority governing the processing of personal data. PII Controller Identification Record A record created with the information provided in the process of PII Controller Identification. So.. if you want to comment on these definitions please do so. I don't believe we have an need to introduce any other new terms, but am willing to listen if someone wants to make the case, and feel free to do so here. By working in this manner we can move ahead independently of meetings and calls and use those to confirm the work being done asynchronously. I would be happy to get a return copy of the attached document from anyone who want to use this to make track changes, as there is still a decent chance that some things may have been missed. I think this is easier than trying to do this via the wiki. Alternatively and likely more easily I have loaded this as a Google doc https://docs.google.com/document/d/1pgTVyGCRuKuWhSAJUMINKuGbwIRyjC7__vitOqQ… And happy to share that with anyone that wants to put in comments or suggest edits in that way. Thanks for your continued support of the work. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

3 6

Quick Poll - Re: Breaking news: opportunity to present ancr work as EU ROPA replacement for SME's
by Mark Lizar 13 May '25

13 May '25

Hi Sal, A receipt based system would be amazing, which is why I want to reference the great work at ANCR, I have drafted an email to promote this work for this purpose, highlighting the progress. My question was slightly more procedural, in that, I was referring to the Controller Identification specification. On a previous wg Call we discussed pulling the controller identification record into its own document and I took this action then I drafted its and i posted this for collaboration, comment - and discussion. https://kantara.atlassian.net/wiki/x/OADaNQ Regardless of whether it makes it to the ANCR roadmap or not? Is there any objection to making saving this wiki page so it is to the public again? I can put a note on it, - saying proposed worked item, if that is a concern, Yes, I object, ___ No, I dont object ____ Abstain ______ Best Regards Mark > On 13 May 2025, at 12:19, Salvatore D'Agostino <sal(a)idmachines.com> wrote: > > So, clearly it would be great to get the EU to move ahead with receipts as means for small business. > > We can take up making this public on the call tomorrow, it is an “off-week” call. So we need to put this out to the list to let people know this is happening. > > From: Tim Reiniger <tsreiniger(a)gmail.com> > Sent: Tuesday, May 13, 2025 12:05 PM > To: Mark Lizar <smartopian(a)icloud.com> > Cc: Salvatore D'Agostino <sal(a)idmachines.com> > Subject: Re: Breaking news: opportunity to present ancr work as EU ROPA replacement for SME's > > Interesting idea to bring Eve Maler back for a reprise on UMA! > > On Tue, May 13, 2025 at 11:47 AM Mark Lizar <smartopian(a)icloud.com <mailto:smartopian@icloud.com>> wrote: > > > > Begin forwarded message: > > From: Mark Lizar <smartopian(a)icloud.com <mailto:smartopian@icloud.com>> > Subject: Breaking news: opportunity to present ancr work as EU ROPA replacement for SME's > Date: 10 May 2025 at 15:10:31 GMT-4 > To: wg-ancr(a)kantarainitiative.org <mailto:wg-ancr@kantarainitiative.org> > > Hi All, > > in light of calls to update the GDPR - and make it easy for Small Business, by derogating the ROPA, record requirements for small businesses in the EU, i reached out to ask, why not implement consent receipts instead? (To the person who put consent receipts in the EU Digital Markets Act in the first place) > > His response was to send him an email with this as an alternative approach so that he can share this with the EU Justice Department team. > > As a part of my response, I would like to update them on how far the Consent Receipt work has evolved in the last 6 years into Standard Operational Transparency record information structure, that can be used for international consent record based information flows. (International Consent which was the objective of the work) > Mentioning how the Kanatara Consent Receipt work was > Used and is in use by industry > Adopted into: > ISO/IEC 27560: 2023 About to become an open standard (in 2025 Fall) > Extending the open and free to access ISO/IEC 29100 - privacy framework (recently updated) > TPI Benchmark for Valid Consent, coming out (next week Tbc) > Conv 108+ being ratified(next month Tbc) > > To add to this, would there be any objections to making the ANCR Controller Identification Record. <https://kantara.atlassian.net/wiki/x/OADaNQ> Spec (On the ANCR Wiki) publicly accessible so I can include it in my response ? > > Best Regards, > > Mark > > > > > > > > Are there any objections to making the draft of the Controller Identification Record Spec publicly accessible ?

2 4

WRT TPI Report - Could it be in time for Privmas?
by Mark Lizar 12 May '25

12 May '25

Hi Sal, (everyone) Do you know if its possible to Release for May 24 - 2025? If so, perhaps we can pick up the Privmas Eve Thread ? Would anyone/everyone be interested in an Open Zoom Call - presenting the work on Monday 26th of May? If so, Maybe we can invite some of our favourite identerati, and invite parallel efforts that might find use for the TPI? e.g. - support this work contribution to efforts working in delegation, or immortal consent topics? Best, Mark Proposing Monday May 26 - (Catchy title) 10:00 am - 12:00 pm (Tentative) Agenda -(to be collaborated on) * 2025 the Year Digital Privacy Transparency Becomes a Standard? privacy transparency to scale consent (and govern surveillance /AI)? Present TPI Report * TPI Report Use Case(s) 27560 going to be open The Digital Identity Transparency Layer Landscape ? (Special Guest Speaker)

1 0

Minutes - meeting April 23rd
by Gigi Agassini 11 May '25

11 May '25

Dear ANCR WG Thank you for attending our meeting on Wednesday, April 23rd. Please find the link to the minutes, which include the key actions and discussions we covered: Meeting Minutes<https://kantara.atlassian.net/wiki/x/DQBYOg> If you notice anything missing or have any questions, please don’t hesitate to reach out. Additionally, please mark your calendars for our next Working Session on Wednesday, April 30th at 1:00 PM EST. The meeting link remains the same. Meeting Link<https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09> Looking forward to seeing you all there! Kindest Regards, Gigi Agassini

1 1

Breaking news: opportunity to present ancr work as EU ROPA replacement for SME's
by Mark Lizar 10 May '25

10 May '25

Hi All, in light of calls to update the GDPR - and make it easy for Small Business, by derogating the ROPA, record requirements for small businesses in the EU, i reached out to ask, why not implement consent receipts instead? (To the person who put consent receipts in the EU Digital Markets Act in the first place) His response was to send him an email with this as an alternative approach so that he can share this with the EU Justice Department team. As a part of my response, I would like to update them on how far the Consent Receipt work has evolved in the last 6 years into Standard Operational Transparency record information structure, that can be used for international consent record based information flows. (International Consent which was the objective of the work) Mentioning how the Kanatara Consent Receipt work was Used and is in use by industry Adopted into: ISO/IEC 27560: 2023 About to become an open standard (in 2025 Fall) Extending the open and free to access ISO/IEC 29100 - privacy framework (recently updated) TPI Benchmark for Valid Consent, coming out (next week Tbc) Conv 108+ being ratified(next month Tbc) To add to this, would there be any objections to making the ANCR Controller Identification Record. <https://kantara.atlassian.net/wiki/x/OADaNQ> Spec (On the ANCR Wiki) publicly accessible so I can include it in my response ? Best Regards, Mark Are there any objections to making the draft of the Controller Identification Record Spec publicly accessible ?

1 0

reminder TPR review call
by Salvatore D'Agostino 30 Apr '25

30 Apr '25

On now.. https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

test
by Salvatore D'Agostino 29 Apr '25

29 Apr '25

IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

TPI-R Spec, Semantic Opportunity for nnovation
by Mark Lizar 23 Apr '25

23 Apr '25

Some Notes, Wrt to today’s call, we decided to continue next week, finishing up the spec while we likely await a barrage of last minute inputs, and we havent even discussed the idea of extending the deadline. (Common practice ;-) Today, we actually accomplished work on terms, draft list now here <https://kantara.atlassian.net/wiki/x/EQDTNw> We also decided to be specific to scope of legal terms, and notice obligations that are specified legally, in particular those with regards to permission to be identified. (Of using a cookie) To this point, I invite everyone to interpret - Quebec Law 25, wherein, it references in 8.1 (quoted below) and see if there is a missing control we can add ? "any person who collects personal information from the person concerned using technology that includes functions allowing the person concerned to be identified,located or profiled must first inform the person (1) of the use of such technology; and (2) of the means available to activate the functions that allow a person to be identified, located or profiled.” The complaint for the TPR focuses online identified, (not location or profiling) and the law here indicates a control that is not opt-in, but turn on. Does this resemble an online control ? (An example would be nice) While the current T&C environment is opt-out, as it is mainly US Service based, -could this be a - turn on - identification, button? Would this also be. Notice record (in our spec), a ROPA in the EU, and a consent receipt? Best, Mark

1 0

Fw: Public Comment to the Joint Committee on Advancing Information Technology, the Internet and Cybersecurity
by Salvatore D'Agostino 22 Apr '25

22 Apr '25

________________________________ From: Salvatore D'Agostino Sent: Monday, April 14, 2025 4:56 PM To: Tricia.Farley-Bouvier(a)mahouse.gov <Tricia.Farley-Bouvier(a)mahouse.gov>; Michael.Moore(a)masenate.gov <Michael.Moore(a)masenate.gov> Cc: Daniel Schleifer <dan(a)idmachines.com>; gigi.agassini(a)gmail.com <gigi.agassini(a)gmail.com> Subject: Public Comment to the Joint Committee on Advancing Information Technology, the Internet and Cybersecurity Joint Committee on Advanced Information Technology, the Internet and Cybersecurity Chairs, Thank you for the opportunity to comment on the legislation under consideration. The ability of security and privacy professionals to apply their skills for good are greatly enhanced by the power of law. Too often security measures and privacy compliance are put in place only as a reaction to something gone wrong. The comprehensive slate of legislation here empowers better design and operation of data processing systems, and associated products and services by organizations and citizens. Massachusetts and the United States have, in the past, led the way in terms of privacy rights and frameworks. The Fair Information Practice Principles (FIPPs<https://www.fpc.gov/resources/fipps/>) that are adopted into the ISO/IEC 29100:2024<https://www.iso.org/standard/85938.html> Privacy framework from 50 years ago still apply today. It is good to see Massachusetts come back into the fight with other states across the country in enacting substantial legislation. The Kantara Initiative, where I chair a workgroup<https://kantarainitiative.org/work-groups/ancr/> on Anchored Notice and Consent Receipt, recently published for public comment a set of transparency performance indicators that can be used to measure whether there is a valid basis for consent. This legislation provides the ability to add further to legal requirements that help to define consent. S45 and H78 for example have excellent language around the requirements for consent. What exists today in too many cases are the dark patterns referenced in the legislation, provides a light to expose and change them. In the work we do we reference laws and frameworks to create security and privacy technology for people, this legislation helps. At IDmachines, we believe that there is a great opportunity for innovation when it comes to privacy and security for people. We believe this can be done in a way that benefits all stakeholders, and provide a better data economy, and that we can do that in Massachusetts. In addition to the legislation we need privacy and security infrastructure for people. While that may seem like a big dig, it in fact can be done with a fraction of the investment and provide tremendous benefits to the Commonwealth its citizens and beyond. We can create an alternative to surveillance valley that provides more useful, secure, and private digital, and real world identity, access, and mobility. The establishment of a public registry for 3rd party collecting entities could be expanded to all PII Controllers, including all covered entities in the legislation. It could include all that operate in the state of MA. It would provide sufficient information so that people could understand who they are dealing with, as could a program operating on their behalf, as to whether their status as a covered entity was in good standing, in effect the availability of a certificate of good standing, and in the case of where they are not registered in the Commonwealth, the same from the jurisdiction of their registration. In the past, I had the honor to serve as the Chair and President of the Identity Ecosystem Steering Group, a public-private partnership in cooperation with the National Institute of Standards and Technology. We published and stood up an initial registry<https://idefregistry.edufoundation.kantarainitiative.org/>. There now exists an significant opportunity, even perhaps more than before. The attached recommendation gives an example of the information that could be aggregated into controller records in that registry. It would better enable direct digital interactions between people and organizations. It is possible to go beyond managing data brokers to enabling dynamic direct data, business, and personal exchanges and reduce the need and impact of things in the middle. Respectfully, Salvatore D’Agostino IDmachines LLC 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

2 1

ANCR WG Minutes and Reminder for ANCR WG working session tomorrow
by Gigi Agassini 15 Apr '25

15 Apr '25

Dear ANCR WG. Thank you for attending Wednesday 9th's meeting. Please find the link to the minutes, which include the actions and discussions we covered: https://kantara.atlassian.net/wiki/x/MIBROQ If you notice anything missing or have any questions, please don't hesitate to reach out. This is a reminder for our ANCR WG Working session tomorrow Wednesday, April 16th at 1.00pm EST. meeting link: https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 Best regards, Gigi Agassini

1 0

FW: NEW | Privacy Framework 1.1 Initial Public Draft Release
by Salvatore D'Agostino 14 Apr '25

14 Apr '25

From: NIST Cybersecurity and Privacy Program <csrc.nist(a)service.govdelivery.com> Sent: Monday, April 14, 2025 3:07 PM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: NEW | Privacy Framework 1.1 Initial Public Draft Release <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/04/248…> View As Web Page<https://links-1.govdelivery.com/CL0/https:%2F%2Fcontent.govdelivery.com%2Fa…> <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/09/280…> NIST Cybersecurity and Privacy Program NEW | Privacy Framework 1.1 Initial Public Draft Release NIST is pleased to announce the release of the Privacy Framework 1.1 Initial Public Draft (IPD)<https://links-1.govdelivery.com/CL0/https:%2F%2Fdoi.org%2F10.6028%2FNIST.CS…>! The NIST Privacy Framework is a “living” tool meant to evolve to meet stakeholder needs, and the time has come to update to Version 1.1. This update builds on the success of Privacy Framework 1.0 by responding to current privacy risk management needs, realigning with NIST Cybersecurity Framework (CSF) 2.0, and enhancing usability. The following resources are included with the Privacy Framework 1.1 IPD release: * Privacy Framework 1.1 IPD Highlights video<https://links-1.govdelivery.com/CL0/https:%2F%2Fvimeo.com%2F1075421918%2F57…> that summarizes the development process and reviews key updates. * Mapping of Privacy Framework 1.0 Core to Privacy Framework 1.1 Core<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nist.gov%2Fdocument%2Fp…> to help organizations trace changes to Core Categories and Subcategories between Framework versions. NIST welcomes stakeholder feedback on the Privacy Framework 1.1 IPD by June 13, 2025. For more information, including a comment template and instructions for submitting feedback, please click the button below. To receive periodic updates and hear about other opportunities to engage, subscribe to our Privacy Engineering mailing list<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…>. If you have questions, please contact us at privacyframework(a)nist.gov<mailto:privacyframework@nist.gov>. Read More<https://links-1.govdelivery.com/CL0/https:%2F%2Fcsrc.nist.gov%2Fpubs%2Fcswp…> NIST Cybersecurity and Privacy Program Questions/Comments about this notice: privacyframework(a)nist.gov<mailto:privacyframework@nist.gov> Connect with us <https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.facebook.com%2FNIST/1/0…><https://links-1.govdelivery.com/CL0/https:%2F%2Ftwitter.com%2FNIST/1/010001…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.youtube.com%2FNIST/1/01…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.linkedin.com%2Fcompany%…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.instagram.com%2Fnist%2F…> Received this email from a friend? Subscribe here<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…>. <https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nist.gov%2Fitl/1/010001…> Subscriber services: Manage Preferences<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Unsubscribe<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Help<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…> _____ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…>. Technical questions? Contact inquiries(a)nist.gov<mailto:inquiries@nist.gov>. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 <https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.granicus.com…> <https://links-1.govdelivery.com/CI1/0100019635b28839-3eb0c0d8-62b7-4ac6-a21…>

1 0

Pirvacy Activity in MA
by Salvatore D'Agostino 14 Apr '25

14 Apr '25

Hi WG, There are written comments due today. I am review this fairly comprehensive set of legislation, and will share my comments with the list. I can submit these as IDmachines and mention the WG, I can also put the WG name on comments. I will try to get these out by noon. Hearing Details - Joint Committee on Advanced Information Technology, the Internet and Cybersecurity<https://malegislature.gov/Events/Hearings/Detail/5114> Also please let me know about the general WG slides. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

slides for Kantara presntations
by Salvatore D'Agostino 13 Apr '25

13 Apr '25

Hi WG, Here are the two slides that will be used at Kantara presentation including EIC and Identiverse. These are due COB tomorrow, comments here. Hope everyone is enjoying the weekend. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

Call today
by Salvatore D'Agostino 09 Apr '25

09 Apr '25

Hi WG, We are still on our existing schedule for a call at noon today with the idea that we shift this to 1 PM starting in two weeks. Agenda pretty much maps to last call. We can review the comments received, work on our slides for the general Kantara presentation, determine what changes we want to make by 5 May and the end of the comment period. I have been reaching out to other communities to get feedback and can talk about that as well on the call. ANCR WG 20250409 Draft - WG - ANCR - Kantara Initiative<https://kantara.atlassian.net/wiki/spaces/WA/pages/961642544/ANCR+WG+202504…> Agenda https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 Zoom Link Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

Fwd: REMINDER - NOTICE FOR PUBLIC COMMENTS/IPR REVIEW: Transparency Performance Reporting (ANCR Draft Recommendation)
by Mark Lizar 06 Apr '25

06 Apr '25

Hi All, With this amazing announcement, We at ANCR ask, Is there Digital Trust without Consent? An identifier is a component of a consent receipt. Is there data sovereignty without consent, is there a digital wallet without consent ? Is there AI without consent? ANCR WG: the Blog Post WRT Real Consent Receipt <https://kantara.atlassian.net/wiki/x/egAfOQ?atlOrigin=eyJpIjoiMjAzZTM4N2ZkZ…> is posted to champion international data governance interoperability, with digital identification management. (A response to W3C DPV) Should Privacy Govern Surveillance ? Mark > Begin forwarded message: > > From: "Kantara Initiative" <general(a)kantarainitiative.org> > Subject: REMINDER - NOTICE FOR PUBLIC COMMENTS/IPR REVIEW: Transparency Performance Reporting (ANCR Draft Recommendation) > Date: 4 April 2025 at 11:42:46 GMT-4 > To: <mark(a)smartspecies.com> > Reply-To: "Kantara Initiative" <general(a)kantarainitiative.org> > > Unsubscribe <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm%2Fmailin…> > <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> > Dear Kantara Initiative Community: > This is a reminder of formal notification that the Anchored Notice and Consent Receipt Work Group (ANCR) has approved the following document as a Draft Recommendation and its distribution for Public Comment and IPR Review: > > Document: Transparency Performance Reporting: A Tool for Assessment of Digital Identification Surveillance > > Version: 1.0 > > Document Date: 2025-02-12 > > Notice and Document available HERE <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…>. > > In accordance with the Kantara Initiative Operating Procedures <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…>, this document now enters a 45-day public comment and IPR review period in preparation for an All-Member Ballot to consider its approval as a Kantara Initiative Recommendation. This is an open invitation to comment. Kantara Initiative solicits feedback from potential users, developers, and other interested parties, whether Kantara Initiative members or not, for the sake of improving the interoperability and quality of its technical work. > > Public Review and IPR Review Period Opens: 2025-03-21, 01:00 PM ET > > Review Period Closes: 2025-05-05, 01:00 PM ET > > Document Abstract: > > Transparency Performance Reporting (TPR) is a novel approach to digital transparency and data control reporting. TPR clarifies when a notice and consent receipt is required and its validity and provides a litmus test for valid consent. TPR uses 4 transparency performance indicators (TPIs) – the timing of the notice, the content of the notice, access and usefulness of the notice, and sovereignty of authority and security – to measure the transparency of the Personally Identifiable Information (PII) Controller notice of risk to the personal data of the PII Principal. This represents a significant advancement for decentralizing digital identification and data surveillance governance within data flows. > > TPR includes mapping to privacy frameworks including Convention 108+, a commonwealth data governance framework that covers 2.5 billion people, and with it an interoperable set of requirements for security and privacy. The mappings show how the TPIs address the requirements for records of processing activities (GDPR Article 30), enable services to be accountable to international (internet) standards for data governance, and create a technical record foundation in a common set of rules allowing people to have their authoritative records of digital identification relationships. > > TPR was developed through volunteer work over three years in the Kantara Initiative Anchored Notice and Consent Receipt Work Group (ANCR) <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…>as a means of understanding and addressing ubiquitous platform and application surveillance while promoting glass-box security and privacy legal standards. > > ____________________ > > Kantara invites your review of this document and asks that you submit any comments and proposed revisions on or before 2025-05-05. As this deadline will be strictly adhered to, late submissions will not be taken into account. > > To Comment on the Recommendation: > > Single comment: Public Comment Form <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> > Multiple comments: Kantara-Comment-Template ANCR Transparency Performance Reporting Recommendation.xlsx <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> > Send your comments via email to staff@ kantarainitiative.org <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> with the subject “(ANR TPR COMMENT SUBMISSION". > _____________ > > Intellectual Property Rights Notice: > > Intellectual Property Rights Notice: In accordance with the Kantara Initiative IPR Policy <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…>Appendix B Article 5 and the Kantara Initiative Operating Procedures <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> Section 7.5, you have a period of 45 days to review the document for any Necessary Claims that may be implicated by the final Recommendation. > > Note that any submissions are deemed to be contributed under the IPR Option of ANCR: Reciprocal Royalty Free with Opt-out to Reasonable and Non-Discriminatory <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> (RAND) > > While there is no requirement to review your patent portfolio for Necessary Claims, please be advised that unless you provide a licensing objection in accordance with the Kantara Initiative IPR Policy Article 5 or a notice of withdrawal in accordance with Kantara Initiative IPR Policy Article 6 on or before 2025-05-05 you will have committed to the licensing provisions as set forth by the Patent & Copyright: (Reciprocal Royalty Free with Opt-out to Reasonable and Non-Discriminatory <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> (RAND)) IPR Policy with respect to any Necessary Claims implicated by the final approved document. > > ANCR Participants <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> are required to make claims to IPR regarding these technical documents. Having signed the Group Participation Agreement (GPA) all members of ANCR should be familiar with these documents, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark, and license rights that read on an approved Kantara Initiative Recommendation. > > Kantara Initiative invites any other persons who know of any part of this Group output that would infringe on third-party intellectual property rights to disclose such infringement claims so that these claims may be provided to the Group members for resolution. If you are not an ANCR Participant, you have no IPR licensing obligation to any of these documents. > > To submit an Intellectual Property Rights infringement claim, email staff(a)kantarainitiative.org <mailto:staff@kantarainitiative.org> with the subject "ANCR TPR IPR CLAIM". > > ____________________ > > Please contact the Kantara Initiative staff at staff(a)kantarainitiative.org <mailto:staff@kantarainitiative.org> with any questions regarding this notice. > > We thank you for your time and continued support of Kantara Initiative! > > >

1 0

FYI - 27091 AI Transparency text submitted with consent receipt use case
by Mark Lizar 04 Apr '25

04 Apr '25

HI All, I have provided some text to propose pii principal transparency, am not sure if it will be used, or useful. But, the excercise has been very helpful. Pleas find this attached, Mark

1 0

Clarifying the Consent Receipt Use Case in 27560
by Mark Lizar 31 Mar '25

31 Mar '25

HI Everyone, Now that 27560 is going to be open, I have looked into recent work on 27560, and 29184, so I could try and locate where the consent receipt use case has gone awry exactly, in addition, to provide Transparency Report Specific references to support the use of Consent Receipts, to enable Controller compliance. Its clear the Consent Receipt use case to regulate digital identity trust and address surveillance capitalism is still a big deal, and something that perhaps the ANCR WG can support, to educate the industry on a way for human data control and interoperability with consent and identity management. Aka the Consent Receipt. To this end, I have drafted some comments/ update to the Consent Receipt use case, to the W3C DPV, Group and to provide the legal references to request updates to the proposed 27560. Would these comments be supported by ANCR. WG? Best, Marl Core Consent Receipt Use Case - Permission for Identification (or self-identifying with consent) As the researcher, developer and editor of the Consent Receipt, and editor of the Transparency Performane Report at the ANCR WG. I would like to clarity the core use case for the consent receipt, to demonstrate how to decentralised the govern of digital identification and surveillance with enforceable privacy, transparency, and consent regulation. To this end, I would request a review of notice and consent in DPV (and 27560), with regards to the associated guidance found in particular Associating Identity with Consent <https://harshp.com/research/publications/038-comparison-notice-requirements…> “Additionally, GDPR encourages using an identifier so that controllers can demonstrate the individual’s given consent (Art.7-1), enable them to withdraw it (Art.7-3), and provide them with a history of their consent events (Art.15).”https://harshp.com/research/publications/038-comparison-notice-req… Referencing Guidelines 05/2020 on consent under Regulation 2016/679 ( point to the guidance which has a different interpretation that what is provided here) “64. >>>> Furthermore, there may be situations where a data controller is processing personal data that does not require the identification of a data subject (for example, with pseudonymized data). In such cases, Article 11.1 may also be relevant as it states that a data controller shall not be obliged to maintain, acquire, or process additional information to identify the data subject solely to comply with the GDPR.” In Article 29 Working Party: Guidelines on transparency under Regulation 2016/679 “106. At the same time, the duty to demonstrate that valid consent has been obtained by a controller should not in itself lead to excessive amounts of additional data processing. This means that controllers should have enough data to show a link to the processing (to show consent was obtained) but shouldn’t be collecting any more information than necessary.” The context of the use case The consent receipt version 1.1 , which was adopted as ISO/IEC 27560, was developed through five years of research and two years of drafting and volunteer community work, originating from Hackathons and Campaigns to stop the biggest lie on the internet: whcich is “Our Data Is Collected without Consent.” Which is now showing to cause significant harms on society (References available upon request) The Issue being addressed If an individual must first be identified to access rights to stop being surveilled online, then privacy is not a right; it is a consumer protection with limited capacity to see and control who can surveil PII principals. This is referred to as the surveillance capitalism use case, which the MVCR and Consent Receipt work solves. Key Points: Without this, people can be surveilled, their data scraped (like with AI), and then they have to opt-out of being tracked, referencing a ‘Consumer Protection’ Paradigm where privacy isn't a fundamental right, and consent is required to surveil people. The consent receipt is the solution to this challenge. Using a standard interaction pattern, well-known in society for trust, that requires fair and proportionate transparency (as explained in Guidance for use of GDPR). It's very simple: Put up a sign, provide a notice, and ask for permission—fundamental components of human etiquette, being polite, and reducing frictions. How does it work; How does this consent receipt work so PII principals can provide permission before being surveilled. A Controller presents their identity in a standard notice (layer 1 of online interaction). This generates a notified record when the PII principal interacts with it. That notified processing activity is mirrored as a consent receipt. A controller digital identifier is provided to the PII principal, instead of a PII principal identifier being taken secretly from the data subject. The data subject can use the receipt (in a secure private space like a digital wallet) to interact with the Controller, send more PII, provide permission to be digitally identified, and self-identify. Consent can be withdrawn with a click. Please consider that at this time, 27560, which is called a consent record, uses a PII principal identifier is in the record header (with an unknown 3rd party ID - for un-notified tracking of people), indicating that this is not consent but a USA-style consumer protection record. Which has significant, security and privacy implications, AS USA Law only affords US citizens consumer rights not afforded to EU or Canadians, under USA Foreign Intelligence Surveillance Laws. As you can imagine, without a real consent receipt and transparency before surveillance, it provides people with much weaker consumer protection, and leaves Canadians open, without rights, or data sovereignty, having a geo-political impact to the international market. Please update text, here especially,https://harshp.com/research/publications/038-comparison-notice-r…

1 1

ANCR WG call reminder - tomorrow 26, march / 12pm EST
by gigi.agassini＠gmail.com 25 Mar '25

25 Mar '25

Dear ANCR WG, This is a kind reminder for our meeting tomorrow, at 12:00pm EST to review: Time Topic 3m WG Admin 10m TPR out for comments for 45d 15m Update homepage 15m Update WG slides (see attached in minutes link)) 5m Blog post 3m Change time of the bi-weekly meeting 8m Any other business 1m Adjourn meeting link: https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 Minutes: https://kantara.atlassian.net/wiki/spaces/WA/pages/942374923/ANCR+WG+2025032 6?force_transition=7e127725-7d77-46d6-9b44-6fa9c5db3c52 Looking forward to seeing you all tomorrow. Kindest Regards, Gigi

1 0

Invitation - Thursday Breakfast Club 7:00 - 7:45 am
by Mark Lizar 25 Mar '25

25 Mar '25

Hello All, We happy to Invite you to 0PN Breakfast Club @ the 0PN Lab, We are resuming the Thursday Breakfast Club, focusing on all the great work that is coming out with regards to Operational Privacy Notice from the ANCR WG, W3C and ISO. This week we invite back the regulars, who might be interested in talking more about the work going on. With a plan to open up invitation to the breakfast club in April. This week there are Announcements and some big news. To find out more, and help spread the word, you are welcome to join the 0PN Breakfast club, where we will report on these initiatives, share the latest gossip, news and research in this field. Call Details: 7:00 - 8:00 am Dropin @ Join on Microsoft Teams <https://teams.microsoft.com/l/meetup-join/19:meeting_NzVlMTM0YzQtYmQwYy00Zm…> See you there, Mark Lizar Check out The Breakfast Club <https://coda.io/d/_dFkt_pKxozn/The-0PN-Breakfast-Club_sucLUgUu> for more information, and even common on the very new Charter. Agenda Topics 1. The Consent receipt from Kantara, now represented in standard at ISO, is to be made open and free to access in 2025! This means it can be used to make international operational transparency open source. #1 0PN project for April. 2. This week the ANCR WG is releasing the Transparency Performance Assessment Report (TPR) for review by Kantara / wider Identity Management Community. The report is the first tool for digital identity management industry to see regulated transparency and Consent for digital identity management is valid. * The TPR can assess consent, security, and sovereignty for compliance with the many consent laws that are becoming enforceable in 2025. 3. ANCR WG is going to be working on terms for the Transparency Report, and discussing how to address misinformation in digital identity management technology, for the next few WG calls, (Tomorrow and ever second Wed) 4. W3C DPV v2.1 was just released, and its getting quite good for mapping the laws to vocabulary, that can be used to operationalised notice, and we are looking at how to use this for Montreal / Consent. Note: - the call will be recorded for the transpcript so that we can support some great blog content. So if you have any news, or updates to report on, please prep them prior to the call.

1 0