- Wg-ancr - mailman.kantarainitiative.org

ANCR WG Minutes and Reminder for ANCR WG working session tomorrow
by Gigi Agassini 15 Apr '25

15 Apr '25

Dear ANCR WG. Thank you for attending Wednesday 9th's meeting. Please find the link to the minutes, which include the actions and discussions we covered: https://kantara.atlassian.net/wiki/x/MIBROQ If you notice anything missing or have any questions, please don't hesitate to reach out. This is a reminder for our ANCR WG Working session tomorrow Wednesday, April 16th at 1.00pm EST. meeting link: https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 Best regards, Gigi Agassini

1 0

FW: NEW | Privacy Framework 1.1 Initial Public Draft Release
by Salvatore D'Agostino 14 Apr '25

14 Apr '25

From: NIST Cybersecurity and Privacy Program <csrc.nist(a)service.govdelivery.com> Sent: Monday, April 14, 2025 3:07 PM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: NEW | Privacy Framework 1.1 Initial Public Draft Release <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/04/248…> View As Web Page<https://links-1.govdelivery.com/CL0/https:%2F%2Fcontent.govdelivery.com%2Fa…> <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/09/280…> NIST Cybersecurity and Privacy Program NEW | Privacy Framework 1.1 Initial Public Draft Release NIST is pleased to announce the release of the Privacy Framework 1.1 Initial Public Draft (IPD)<https://links-1.govdelivery.com/CL0/https:%2F%2Fdoi.org%2F10.6028%2FNIST.CS…>! The NIST Privacy Framework is a “living” tool meant to evolve to meet stakeholder needs, and the time has come to update to Version 1.1. This update builds on the success of Privacy Framework 1.0 by responding to current privacy risk management needs, realigning with NIST Cybersecurity Framework (CSF) 2.0, and enhancing usability. The following resources are included with the Privacy Framework 1.1 IPD release: * Privacy Framework 1.1 IPD Highlights video<https://links-1.govdelivery.com/CL0/https:%2F%2Fvimeo.com%2F1075421918%2F57…> that summarizes the development process and reviews key updates. * Mapping of Privacy Framework 1.0 Core to Privacy Framework 1.1 Core<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nist.gov%2Fdocument%2Fp…> to help organizations trace changes to Core Categories and Subcategories between Framework versions. NIST welcomes stakeholder feedback on the Privacy Framework 1.1 IPD by June 13, 2025. For more information, including a comment template and instructions for submitting feedback, please click the button below. To receive periodic updates and hear about other opportunities to engage, subscribe to our Privacy Engineering mailing list<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…>. If you have questions, please contact us at privacyframework(a)nist.gov<mailto:privacyframework@nist.gov>. Read More<https://links-1.govdelivery.com/CL0/https:%2F%2Fcsrc.nist.gov%2Fpubs%2Fcswp…> NIST Cybersecurity and Privacy Program Questions/Comments about this notice: privacyframework(a)nist.gov<mailto:privacyframework@nist.gov> Connect with us <https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.facebook.com%2FNIST/1/0…><https://links-1.govdelivery.com/CL0/https:%2F%2Ftwitter.com%2FNIST/1/010001…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.youtube.com%2FNIST/1/01…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.linkedin.com%2Fcompany%…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.instagram.com%2Fnist%2F…> Received this email from a friend? Subscribe here<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…>. <https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nist.gov%2Fitl/1/010001…> Subscriber services: Manage Preferences<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Unsubscribe<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Help<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…> _____ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…>. Technical questions? Contact inquiries(a)nist.gov<mailto:inquiries@nist.gov>. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 <https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.granicus.com…> <https://links-1.govdelivery.com/CI1/0100019635b28839-3eb0c0d8-62b7-4ac6-a21…>

1 0

Pirvacy Activity in MA
by Salvatore D'Agostino 14 Apr '25

14 Apr '25

Hi WG, There are written comments due today. I am review this fairly comprehensive set of legislation, and will share my comments with the list. I can submit these as IDmachines and mention the WG, I can also put the WG name on comments. I will try to get these out by noon. Hearing Details - Joint Committee on Advanced Information Technology, the Internet and Cybersecurity<https://malegislature.gov/Events/Hearings/Detail/5114> Also please let me know about the general WG slides. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

slides for Kantara presntations
by Salvatore D'Agostino 13 Apr '25

13 Apr '25

Hi WG, Here are the two slides that will be used at Kantara presentation including EIC and Identiverse. These are due COB tomorrow, comments here. Hope everyone is enjoying the weekend. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

Call today
by Salvatore D'Agostino 09 Apr '25

09 Apr '25

Hi WG, We are still on our existing schedule for a call at noon today with the idea that we shift this to 1 PM starting in two weeks. Agenda pretty much maps to last call. We can review the comments received, work on our slides for the general Kantara presentation, determine what changes we want to make by 5 May and the end of the comment period. I have been reaching out to other communities to get feedback and can talk about that as well on the call. ANCR WG 20250409 Draft - WG - ANCR - Kantara Initiative<https://kantara.atlassian.net/wiki/spaces/WA/pages/961642544/ANCR+WG+202504…> Agenda https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 Zoom Link Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

Fwd: REMINDER - NOTICE FOR PUBLIC COMMENTS/IPR REVIEW: Transparency Performance Reporting (ANCR Draft Recommendation)
by Mark Lizar 05 Apr '25

05 Apr '25

Hi All, With this amazing announcement, We at ANCR ask, Is there Digital Trust without Consent? An identifier is a component of a consent receipt. Is there data sovereignty without consent, is there a digital wallet without consent ? Is there AI without consent? ANCR WG: the Blog Post WRT Real Consent Receipt <https://kantara.atlassian.net/wiki/x/egAfOQ?atlOrigin=eyJpIjoiMjAzZTM4N2ZkZ…> is posted to champion international data governance interoperability, with digital identification management. (A response to W3C DPV) Should Privacy Govern Surveillance ? Mark > Begin forwarded message: > > From: "Kantara Initiative" <general(a)kantarainitiative.org> > Subject: REMINDER - NOTICE FOR PUBLIC COMMENTS/IPR REVIEW: Transparency Performance Reporting (ANCR Draft Recommendation) > Date: 4 April 2025 at 11:42:46 GMT-4 > To: <mark(a)smartspecies.com> > Reply-To: "Kantara Initiative" <general(a)kantarainitiative.org> > > Unsubscribe <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm%2Fmailin…> > <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> > Dear Kantara Initiative Community: > This is a reminder of formal notification that the Anchored Notice and Consent Receipt Work Group (ANCR) has approved the following document as a Draft Recommendation and its distribution for Public Comment and IPR Review: > > Document: Transparency Performance Reporting: A Tool for Assessment of Digital Identification Surveillance > > Version: 1.0 > > Document Date: 2025-02-12 > > Notice and Document available HERE <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…>. > > In accordance with the Kantara Initiative Operating Procedures <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…>, this document now enters a 45-day public comment and IPR review period in preparation for an All-Member Ballot to consider its approval as a Kantara Initiative Recommendation. This is an open invitation to comment. Kantara Initiative solicits feedback from potential users, developers, and other interested parties, whether Kantara Initiative members or not, for the sake of improving the interoperability and quality of its technical work. > > Public Review and IPR Review Period Opens: 2025-03-21, 01:00 PM ET > > Review Period Closes: 2025-05-05, 01:00 PM ET > > Document Abstract: > > Transparency Performance Reporting (TPR) is a novel approach to digital transparency and data control reporting. TPR clarifies when a notice and consent receipt is required and its validity and provides a litmus test for valid consent. TPR uses 4 transparency performance indicators (TPIs) – the timing of the notice, the content of the notice, access and usefulness of the notice, and sovereignty of authority and security – to measure the transparency of the Personally Identifiable Information (PII) Controller notice of risk to the personal data of the PII Principal. This represents a significant advancement for decentralizing digital identification and data surveillance governance within data flows. > > TPR includes mapping to privacy frameworks including Convention 108+, a commonwealth data governance framework that covers 2.5 billion people, and with it an interoperable set of requirements for security and privacy. The mappings show how the TPIs address the requirements for records of processing activities (GDPR Article 30), enable services to be accountable to international (internet) standards for data governance, and create a technical record foundation in a common set of rules allowing people to have their authoritative records of digital identification relationships. > > TPR was developed through volunteer work over three years in the Kantara Initiative Anchored Notice and Consent Receipt Work Group (ANCR) <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…>as a means of understanding and addressing ubiquitous platform and application surveillance while promoting glass-box security and privacy legal standards. > > ____________________ > > Kantara invites your review of this document and asks that you submit any comments and proposed revisions on or before 2025-05-05. As this deadline will be strictly adhered to, late submissions will not be taken into account. > > To Comment on the Recommendation: > > Single comment: Public Comment Form <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> > Multiple comments: Kantara-Comment-Template ANCR Transparency Performance Reporting Recommendation.xlsx <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> > Send your comments via email to staff@ kantarainitiative.org <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> with the subject “(ANR TPR COMMENT SUBMISSION". > _____________ > > Intellectual Property Rights Notice: > > Intellectual Property Rights Notice: In accordance with the Kantara Initiative IPR Policy <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…>Appendix B Article 5 and the Kantara Initiative Operating Procedures <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> Section 7.5, you have a period of 45 days to review the document for any Necessary Claims that may be implicated by the final Recommendation. > > Note that any submissions are deemed to be contributed under the IPR Option of ANCR: Reciprocal Royalty Free with Opt-out to Reasonable and Non-Discriminatory <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> (RAND) > > While there is no requirement to review your patent portfolio for Necessary Claims, please be advised that unless you provide a licensing objection in accordance with the Kantara Initiative IPR Policy Article 5 or a notice of withdrawal in accordance with Kantara Initiative IPR Policy Article 6 on or before 2025-05-05 you will have committed to the licensing provisions as set forth by the Patent & Copyright: (Reciprocal Royalty Free with Opt-out to Reasonable and Non-Discriminatory <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> (RAND)) IPR Policy with respect to any Necessary Claims implicated by the final approved document. > > ANCR Participants <https://kantarainitiative.org/membership/?civiwp=CiviCRM&q=civicrm/mailing/…> are required to make claims to IPR regarding these technical documents. Having signed the Group Participation Agreement (GPA) all members of ANCR should be familiar with these documents, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark, and license rights that read on an approved Kantara Initiative Recommendation. > > Kantara Initiative invites any other persons who know of any part of this Group output that would infringe on third-party intellectual property rights to disclose such infringement claims so that these claims may be provided to the Group members for resolution. If you are not an ANCR Participant, you have no IPR licensing obligation to any of these documents. > > To submit an Intellectual Property Rights infringement claim, email staff(a)kantarainitiative.org <mailto:staff@kantarainitiative.org> with the subject "ANCR TPR IPR CLAIM". > > ____________________ > > Please contact the Kantara Initiative staff at staff(a)kantarainitiative.org <mailto:staff@kantarainitiative.org> with any questions regarding this notice. > > We thank you for your time and continued support of Kantara Initiative! > > >

1 0

FYI - 27091 AI Transparency text submitted with consent receipt use case
by Mark Lizar 04 Apr '25

04 Apr '25

HI All, I have provided some text to propose pii principal transparency, am not sure if it will be used, or useful. But, the excercise has been very helpful. Pleas find this attached, Mark

1 0

Clarifying the Consent Receipt Use Case in 27560
by Mark Lizar 31 Mar '25

31 Mar '25

HI Everyone, Now that 27560 is going to be open, I have looked into recent work on 27560, and 29184, so I could try and locate where the consent receipt use case has gone awry exactly, in addition, to provide Transparency Report Specific references to support the use of Consent Receipts, to enable Controller compliance. Its clear the Consent Receipt use case to regulate digital identity trust and address surveillance capitalism is still a big deal, and something that perhaps the ANCR WG can support, to educate the industry on a way for human data control and interoperability with consent and identity management. Aka the Consent Receipt. To this end, I have drafted some comments/ update to the Consent Receipt use case, to the W3C DPV, Group and to provide the legal references to request updates to the proposed 27560. Would these comments be supported by ANCR. WG? Best, Marl Core Consent Receipt Use Case - Permission for Identification (or self-identifying with consent) As the researcher, developer and editor of the Consent Receipt, and editor of the Transparency Performane Report at the ANCR WG. I would like to clarity the core use case for the consent receipt, to demonstrate how to decentralised the govern of digital identification and surveillance with enforceable privacy, transparency, and consent regulation. To this end, I would request a review of notice and consent in DPV (and 27560), with regards to the associated guidance found in particular Associating Identity with Consent <https://harshp.com/research/publications/038-comparison-notice-requirements…> “Additionally, GDPR encourages using an identifier so that controllers can demonstrate the individual’s given consent (Art.7-1), enable them to withdraw it (Art.7-3), and provide them with a history of their consent events (Art.15).”https://harshp.com/research/publications/038-comparison-notice-req… Referencing Guidelines 05/2020 on consent under Regulation 2016/679 ( point to the guidance which has a different interpretation that what is provided here) “64. >>>> Furthermore, there may be situations where a data controller is processing personal data that does not require the identification of a data subject (for example, with pseudonymized data). In such cases, Article 11.1 may also be relevant as it states that a data controller shall not be obliged to maintain, acquire, or process additional information to identify the data subject solely to comply with the GDPR.” In Article 29 Working Party: Guidelines on transparency under Regulation 2016/679 “106. At the same time, the duty to demonstrate that valid consent has been obtained by a controller should not in itself lead to excessive amounts of additional data processing. This means that controllers should have enough data to show a link to the processing (to show consent was obtained) but shouldn’t be collecting any more information than necessary.” The context of the use case The consent receipt version 1.1 , which was adopted as ISO/IEC 27560, was developed through five years of research and two years of drafting and volunteer community work, originating from Hackathons and Campaigns to stop the biggest lie on the internet: whcich is “Our Data Is Collected without Consent.” Which is now showing to cause significant harms on society (References available upon request) The Issue being addressed If an individual must first be identified to access rights to stop being surveilled online, then privacy is not a right; it is a consumer protection with limited capacity to see and control who can surveil PII principals. This is referred to as the surveillance capitalism use case, which the MVCR and Consent Receipt work solves. Key Points: Without this, people can be surveilled, their data scraped (like with AI), and then they have to opt-out of being tracked, referencing a ‘Consumer Protection’ Paradigm where privacy isn't a fundamental right, and consent is required to surveil people. The consent receipt is the solution to this challenge. Using a standard interaction pattern, well-known in society for trust, that requires fair and proportionate transparency (as explained in Guidance for use of GDPR). It's very simple: Put up a sign, provide a notice, and ask for permission—fundamental components of human etiquette, being polite, and reducing frictions. How does it work; How does this consent receipt work so PII principals can provide permission before being surveilled. A Controller presents their identity in a standard notice (layer 1 of online interaction). This generates a notified record when the PII principal interacts with it. That notified processing activity is mirrored as a consent receipt. A controller digital identifier is provided to the PII principal, instead of a PII principal identifier being taken secretly from the data subject. The data subject can use the receipt (in a secure private space like a digital wallet) to interact with the Controller, send more PII, provide permission to be digitally identified, and self-identify. Consent can be withdrawn with a click. Please consider that at this time, 27560, which is called a consent record, uses a PII principal identifier is in the record header (with an unknown 3rd party ID - for un-notified tracking of people), indicating that this is not consent but a USA-style consumer protection record. Which has significant, security and privacy implications, AS USA Law only affords US citizens consumer rights not afforded to EU or Canadians, under USA Foreign Intelligence Surveillance Laws. As you can imagine, without a real consent receipt and transparency before surveillance, it provides people with much weaker consumer protection, and leaves Canadians open, without rights, or data sovereignty, having a geo-political impact to the international market. Please update text, here especially,https://harshp.com/research/publications/038-comparison-notice-r…

1 1

ANCR WG call reminder - tomorrow 26, march / 12pm EST
by gigi.agassini＠gmail.com 25 Mar '25

25 Mar '25

Dear ANCR WG, This is a kind reminder for our meeting tomorrow, at 12:00pm EST to review: Time Topic 3m WG Admin 10m TPR out for comments for 45d 15m Update homepage 15m Update WG slides (see attached in minutes link)) 5m Blog post 3m Change time of the bi-weekly meeting 8m Any other business 1m Adjourn meeting link: https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 Minutes: https://kantara.atlassian.net/wiki/spaces/WA/pages/942374923/ANCR+WG+2025032 6?force_transition=7e127725-7d77-46d6-9b44-6fa9c5db3c52 Looking forward to seeing you all tomorrow. Kindest Regards, Gigi

1 0

Invitation - Thursday Breakfast Club 7:00 - 7:45 am
by Mark Lizar 25 Mar '25

25 Mar '25

Hello All, We happy to Invite you to 0PN Breakfast Club @ the 0PN Lab, We are resuming the Thursday Breakfast Club, focusing on all the great work that is coming out with regards to Operational Privacy Notice from the ANCR WG, W3C and ISO. This week we invite back the regulars, who might be interested in talking more about the work going on. With a plan to open up invitation to the breakfast club in April. This week there are Announcements and some big news. To find out more, and help spread the word, you are welcome to join the 0PN Breakfast club, where we will report on these initiatives, share the latest gossip, news and research in this field. Call Details: 7:00 - 8:00 am Dropin @ Join on Microsoft Teams <https://teams.microsoft.com/l/meetup-join/19:meeting_NzVlMTM0YzQtYmQwYy00Zm…> See you there, Mark Lizar Check out The Breakfast Club <https://coda.io/d/_dFkt_pKxozn/The-0PN-Breakfast-Club_sucLUgUu> for more information, and even common on the very new Charter. Agenda Topics 1. The Consent receipt from Kantara, now represented in standard at ISO, is to be made open and free to access in 2025! This means it can be used to make international operational transparency open source. #1 0PN project for April. 2. This week the ANCR WG is releasing the Transparency Performance Assessment Report (TPR) for review by Kantara / wider Identity Management Community. The report is the first tool for digital identity management industry to see regulated transparency and Consent for digital identity management is valid. * The TPR can assess consent, security, and sovereignty for compliance with the many consent laws that are becoming enforceable in 2025. 3. ANCR WG is going to be working on terms for the Transparency Report, and discussing how to address misinformation in digital identity management technology, for the next few WG calls, (Tomorrow and ever second Wed) 4. W3C DPV v2.1 was just released, and its getting quite good for mapping the laws to vocabulary, that can be used to operationalised notice, and we are looking at how to use this for Montreal / Consent. Note: - the call will be recorded for the transpcript so that we can support some great blog content. So if you have any news, or updates to report on, please prep them prior to the call.

1 0

Transparency Performance Reporting Public Review and Comment Period Open
by Salvatore D'Agostino 24 Mar '25

24 Mar '25

Hi ANCR, RIUP, and PEMC. We have a Kantara Recommendation that is now out for public comment. PCIPR20250317 - ANCR Transparency Performance Reporting - General Information - Kantara Initiative<https://kantara.atlassian.net/wiki/spaces/GI/pages/925663233/PCIPR20250317+…> Here is the link to the document as well as the reporting forms. Congratulations to the WG for this effort and thanks for your time in review and comments. Sincerely, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

FW: TPR Draft Recommendation: Public Comments
by Salvatore D'Agostino 20 Mar '25

20 Mar '25

Hip, hip… From: Amanda Gay <amanda(a)kantarainitiative.org> Sent: Thursday, March 20, 2025 4:13 PM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: TPR Draft Recommendation: Public Comments Hi Sal: Everything is prepped for the Public Comment/IPR Period--which will start tomorrow at 1PM! Since 45 days out from today was a Sunday, I didn't send it out today. The Public Comment Period will run from March 21 to May 5. Here's an advance copy of the document for your review. Thanks again for your hard work and continued patience! Best, -Amanda -- Amanda Gay | Work Groups and Membership <https://lh7-rt.googleusercontent.com/docsz/AD_4nXfHwJ-rzpysEzGWLZ07DoUVltjG…> Phone: +1 571-475-8895 LinkedIn: @KantaraInitiative

1 0

FW: [KI-LC] Call to Update Group Slides for 2025
by Salvatore D'Agostino 19 Mar '25

19 Mar '25

Hello WG, Please take a look through the Kantara presentation deck wrt to wg activity, we will need to update, let’s talk about that over the next few meetings. We can create a pair of draft slides as placeholder to get started. Comments here in thread as well? Kind regards, Sal From: Alec L via LC <lc(a)kantarainitiative.org> Sent: Wednesday, March 19, 2025 9:45 AM To: Kantara Leadership Council <lc(a)kantarainitiative.org> Subject: [KI-LC] Call to Update Group Slides for 2025 Hi all, With EIC and Identiverse coming up, it's time for each group to refresh our presentation slides with their 2024 achievements and 2025 plans. This activity helps Kay accurately represent your group's work and attract new members and participation The shared presentation can be found here: https://docs.google.com/presentation/d/1j__6HOA8BuDWPcYsY3Q7DETpGmbNZ34s/ed… Please update your group's section before our next monthly meeting, Apr 15, 2025 @ 10ET Thanks, - Alec Alec Laws CTO Engineering | IDENTOS Inc. <https://cdn2.hubspot.net/hubfs/53/tools/email-signature-generator/icons/pho…> (647)-822-1529<tel:(647)-822-1529> <https://cdn2.hubspot.net/hubfs/53/tools/email-signature-generator/icons/ema…> alec(a)identos.ca<mailto:alec@identos.ca> <https://uploads-ssl.webflow.com/650c9dbaffb52efc03fda0ca/656f37e5c28b666130…> <https://twitter.com/identos_inc> <https://www.linkedin.com/company/identos-inc/>

1 0

Cannot host call
by Salvatore D'Agostino 12 Mar '25

12 Mar '25

Hi WG, Sorry for this but timing isn't working today as I have to pick up Sarah who has just had a procedure, and she comes out at 12:30. Also, Gigi is on vacation this week. The TPR document should be formatted with appreciation from Amanda and Kantara this week and be ready to share for public comment, clearly, we all want to be able to cross that milestone, and that it happens shortly. There are drafts of blog post associated with the TPR to share with Kantara and promoting this. Best, Sal

3 2

Updates: 27560 Comment & ANCR Controller Draft is Posted
by Mark Lizar 04 Mar '25

04 Mar '25

Dear WG, The 2 Updates, 1. posted an initial spec outline for the Controller_notice_ Id record draft <https://kantara.atlassian.net/wiki/x/OADaNQ?atlOrigin=eyJpIjoiYTU3NDA5ZTRjY…> taken from the appendix of ANCR Transparency Reporting specification. It should also contain a link to the google doc in active development. ( Feel free to jump in and comment/ contribute/discuss and edit. if you have ideas for what should be included, or would like to get involved in drafting, please let me know 2. I have also tried to submit late comments - referencing the controller notice id record to 27560, but due to technical account issue (@ standards council of Canada) it was not submitted on time. Even so comments were eventually submitted, so the editors hopefully will get a chance to review them. And, yes, it does recommend the use of the ANCR PII controller_idenitty_ record, (with a Link) to be used in the record information structure, as well as minimumal changes to update to to a notice record and receipt record and information structure, (so as to be suitable for (all use case) including the original Surveillance/Terms and Condition / Cookie use cases). So fingers crossed, the ANCR / Kantara Work might actually work out in the end by not only interoperate in the next edition,with 27560, 29184, 29100, and DPV, but also be useable for ‘operational personal data security/surveillance access and control.’ Which would make the effort definitely worthy while in the end Best, Mark PS. Key Comment Summary #1 comment (imo) is recommending to swap the PII_principal identifier from the record header with with the pii_controller_record_id, (as specified in the ANCR WG) #2 Second most important, is a recommendation of a generic use case for getting permission to identify the pii_principal in the consent record header. (which demo’s how privacy is used for identify management) In the context of providing and withdrawal of consent using a consent receipt for a secondary purpose of use (for any lawful basis) PSS - In essence completing the work to propose a standard that can make a real consent record and receipt 10 years after the v1 was drafted. - comments received or not - is a big milestone in my book.

1 0

ANCR PII Controller Notice Identification Record Draft v0.8
by Info 03 Mar '25

03 Mar '25

Dear WG, I posted an initial spec outline for the Controller_notice_ Id record draft <https://kantara.atlassian.net/wiki/x/OADaNQ?atlOrigin=eyJpIjoiYTU3NDA5ZTRjY…> currently found in the TPR appendix. It contains a link to the google doc in active development. Feel free to jump in and comment on the website posted version if you have ideas for what should be included, or let me know if you want to actively draft or edit, and we can co-ordinate, as we generally aim to work on this doc in a session on Monday afternoons, for the short period of time it will take to draft. Kind Regards, Mark 0PN Director Zero Privacy Needed

1 0

FW: Event Registration | NCCoE Cybersecurity and AI Workshop
by Salvatore D'Agostino 28 Feb '25

28 Feb '25

From: NIST Cybersecurity and Privacy Program <csrc.nist(a)service.govdelivery.com> Sent: Friday, February 28, 2025 12:27 PM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: Event Registration | NCCoE Cybersecurity and AI Workshop Register Now! <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/04/248…> View As Web Page<https://links-1.govdelivery.com/CL0/https:%2F%2Fcontent.govdelivery.com%2Fa…> <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/09/280…> National Cybersecurity Center of Excellence <https://content.govdelivery.com/attachments/fancy_images/USNIST/2025/02/110…> Join Us! Register Now for the NCCoE Cybersecurity and AI Workshop Event Date: April 3, 2025 Event Time: 9:00 AM – 5:00 PM EST Event Location: Virtual and at the National Cybersecurity Center of Excellence (NCCoE) Recent advancements in Artificial Intelligence (AI) technology bring great opportunities and challenges to organizations, including how AI can affect their cybersecurity capabilities and risks. The potential positive and negative impacts of AI need to be understood and managed. NIST is proposing the creation of a NIST Cybersecurity Framework (CSF) Profile (Cyber AI Profile), in collaboration with the cybersecurity and AI communities, to focus on three sources of risk that impact an organization’s operational risk: Cybersecurity of AI Systems, AI-enabled Cyber Attacks, and AI-enabled Cyber Defense. To inform these discussions, join our upcoming workshop where we will explore ideas discussed in the newly released Cybersecurity and AI Workshop Concept Paper<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nccoe.nist.gov%2Fprojec…>* through a variety of hybrid presentations and panel discussions and in-person only working sessions. Registration for in-person attendance closes on March 27, 2025. Due to space limitation, registration is limited to the first 150 registrants on a first come, first served basis. There is no registration needed to attend virtually. Please see the link to the event page and watch the stream on April 3, 2025: https://www.nccoe.nist.gov/get-involved/attend-events/cyber-and-ai-workshop<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nccoe.nist.gov%2Fget-in…> We look forward to your participation at this event. *Please provide any feedback using the form found on our project page<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nccoe.nist.gov%2Fprojec…> before 11:59 p.m. EDT on Friday, March 14, 2025, to inform workshop topics. Register Now!<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nccoe.nist.gov%2Fget-in…> Questions/Comments about this notice: CyberAIProfile(a)nist.gov<mailto:CyberAIProfile@nist.gov> NCCoE Website questions: nccoe(a)nist.gov<mailto:nccoe@nist.gov> Connect with us <https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.facebook.com%2FNIST/1/0…><https://links-1.govdelivery.com/CL0/https:%2F%2Ftwitter.com%2FNIST/1/010001…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.youtube.com%2FNIST/1/01…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.linkedin.com%2Fcompany%…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.instagram.com%2Fnist%2F…> Received this email from a friend? Subscribe here<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…>. <https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nist.gov%2Fitl/1/010001…> Subscriber services: Manage Preferences<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Unsubscribe<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Help<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…> _____ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…>. Technical questions? Contact inquiries(a)nist.gov<mailto:inquiries@nist.gov>. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 <https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.granicus.com…> <https://links-1.govdelivery.com/CI1/010001954d994af1-a120e018-5461-4eb6-a4e…>

1 0

ANCR WG - meeting
by gigi.agassini＠gmail.com 26 Feb '25

26 Feb '25

Dear WG, Thank you all for attending today's meeting. As a follow-up, please find the meeting minutes in the link below. I would greatly appreciate any comments or additions you may have. https://kantara.atlassian.net/wiki/spaces/WA/pages/897581057/ANCR+WG+2025022 6 Thank you so much for your attention and looking forward to seeing you all at our next meeting. Kindest regards, Gigi Agassini

2 1

UN Transparency Report
by Salvatore D'Agostino 23 Feb '25

23 Feb '25

Timely, given we are putting out Transparency Performance Reporting for comment this week. Public Review 2: Recommendation No. 49: Transparency at Scale<https://uncefact.unece.org/display/uncefactpublicreview/Public+Review+2%3A+…> Public Review 2: Recommendation No. 49: Transparency at Scale<https://uncefact.unece.org/display/uncefactpublicreview/Public+Review+2%3A+…> Download all the files for Public Review for this project uncefact.unece.org

1 0

Fw: Upcoming security bulletin from Atlassian
by Salvatore D'Agostino 19 Feb '25

19 Feb '25

Rather, that we are taking a more proactive approach to vulnerability transparency ________________________________ From: Atlassian <security(a)e.atlassian.com> Sent: Tuesday, February 18, 2025 1:07 PM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: Upcoming security bulletin from Atlassian [Atlassian]<https://click.e.atlassian.com/?qs=d85a4d3dfbeaad281e6649fd7fe84b7646852aa49…> Security bulletin for vulnerabilities in multiple Atlassian products<https://click.e.atlassian.com/?qs=d85a4d3dfbeaad28bd3284ab57e50b137e34c0d83…> Atlassian has released a bulletin with vulnerabilities and CVEs affecting multiple products. Please keep in mind that the issues included in this bulletin are a result of our increase in scope of vulnerability disclosure. While this change results in an increase of visibility and disclosures, it does not mean there are more vulnerabilities. Rather, that we are taking a more proactive approach to vulnerability transparency and are committed to providing our customers with the information they need to make informed decisions about updating our products. Unlike a critical security advisory, we are not calling for immediate action to be taken from the bulletin. Generally, customers can keep to their existing upgrade schedule unless their own assessment or processes dictate otherwise. Please see the full bulletin learn more. See full bulletin<https://click.e.atlassian.com/?qs=d85a4d3dfbeaad2847f9070172380ace98a6335be…> Kind regards, The Atlassian Team Read in browser<https://view.e.atlassian.com/?qs=75ff950ce47eb27fd09c7f155f9064f3e66529468d…> • Privacy policy<https://click.e.atlassian.com/?qs=d85a4d3dfbeaad288096762415216e3013e154ba0…> • Contact us<https://click.e.atlassian.com/?qs=d85a4d3dfbeaad28a124821f21dc5222db3d310be…> • Read our blog<https://click.e.atlassian.com/?qs=d85a4d3dfbeaad28ff8abae56aa33317a4ae1f5b8…> • Join Atlassian Community<https://click.e.atlassian.com/?qs=d85a4d3dfbeaad28280065e64fe8e25f67bd94f70…> [Facebook]<https://click.e.atlassian.com/?qs=d85a4d3dfbeaad28ed9af9806b1cffee94e7c09db…> [LinkedIn] <https://click.e.atlassian.com/?qs=d85a4d3dfbeaad28d308fc3063901e31ebcf2af87…> [Twitter] <https://click.e.atlassian.com/?qs=d85a4d3dfbeaad287c0eb338fd26886549bd53c51…> Copyright 2025 Atlassian Pty Ltd. All rights reserved. We are located at 341 George Street, Sydney, NSW, 2000, Australia [https://image.e.atlassian.com/lib/fe4011727164047d751070/m/1/Atlassian-logo…]<https://click.e.atlassian.com/?qs=d85a4d3dfbeaad28406d841492c8dd349e0cd560d…> You are receiving this email because this is an important message regarding your account and products you are using. You are not allowed to unsubscribe from this type of message.

1 0

Update on ISO/IEC 27568 Digital Twins inputs
by Mark Lizar 19 Feb '25

19 Feb '25

Hi ANCR, Positive news I had the opportunity to participate and further support the ANCR Work, in ISO/IEC 27568 ad-hoc call, following up on the previous two submissions with the use case for digitally twinning notice, for transparency and the ethical governance of Ai. The work is well received and now being included for a document ballot next month, if all goes well, then a draft next fall. In addition, I mentioned dynamic and operational personal data functions of this use case to Antonio, who mentioned that this is a current topic with Europol. In addition, in the UK, they are calling for comments on a proposed governance framework to reform government services, due before March 8th, Which suggest a secure privacy, with transparency performance reporting, as a use case might be of high short term value. Best, Mark

1 0

Fw: Share Your Thoughts: New Cybersecurity Framework Profile for AI
by Salvatore D'Agostino 14 Feb '25

14 Feb '25

Get Outlook for iOS<https://aka.ms/o0ukef> ________________________________ From: NIST Cybersecurity and Privacy Program <csrc.nist(a)service.govdelivery.com> Sent: Friday, February 14, 2025 4:00:16 PM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: Share Your Thoughts: New Cybersecurity Framework Profile for AI We want to hear from you! [NIST] View As Web Page<https://links-1.govdelivery.com/CL0/https:%2F%2Fcontent.govdelivery.com%2Fa…> [Header] National Cybersecurity Center of Excellence Participate in the Development of a New Cyber AI Profile Recent advancements in Artificial Intelligence (AI) technology bring great opportunities to organizations, but also new risks and impacts that need to be managed in the domain of cybersecurity. NIST is evaluating how to use existing frameworks, such as the NIST Cybersecurity Framework (CSF), to assist organizations as they face new or expanded risks. Discussions with many in the cybersecurity community strongly suggest that there would be value in developing guidance based on the CSF to address these risks. NIST, through the National Cybersecurity Center of Excellence (NCCoE), is considering developing a Community Profile that is based on the CSF (a "Cyber AI Profile"). ________________________________ Share Your Thoughts Now and at Our Upcoming Workshop Cybersecurity, privacy, and AI practitioners are highly valued audiences for a Cyber AI Profile. To provide additional background information around potential approaches for creating the Profile, we have developed the Cybersecurity and AI Workshop Concept Paper<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nccoe.nist.gov%2Fprojec…>. You're invited help us define the scope of this work by providing your thoughts on the concept paper before 11:59 p.m. EDT on Friday, March 14, 2025. We encourage you to submit all feedback using the form found on our project page<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nccoe.nist.gov%2Fprojec…>. Your inputs will inform discussions during our upcoming workshop on Thursday, April 3, 2025. Please save the date! Join the Community of Interest Consider joining the Community of Interest (COI) to receive the latest project news and announcements. Email the team<mailto:CyberAIProfile@nist.gov> declaring your interest or complete the sign-up form on our project page. ________________________________ Questions/Comments about this notice: CyberAIProfile(a)nist.gov<mailto:CyberAIProfile@nist.gov> NCCoE Website questions: nccoe(a)nist.gov<mailto:nccoe@nist.gov> Connect with us [facebook]<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.facebook.com%2FNIST/1/0…>[twitter]<https://links-1.govdelivery.com/CL0/https:%2F%2Ftwitter.com%2FNIST/1/010001…>[youtube]<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.youtube.com%2FNIST/1/01…>[linkedin]<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.linkedin.com%2Fcompany%…>[flickr]<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.instagram.com%2Fnist%2F…> Received this email from a friend? Subscribe here<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…>. [ITL NIST]<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nist.gov%2Fitl/1/010001…> Subscriber services: Manage Preferences<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Unsubscribe<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Help<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…> ________________________________ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…>. Technical questions? Contact inquiries(a)nist.gov<mailto:inquiries@nist.gov>. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 [GovDelivery logo]<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.granicus.com…> [https://links-1.govdelivery.com/CI1/0100019506431e1a-fa9d3ca3-0049-4d83-8e3…]

1 0

Approved WG Draft Kantara Recommendation Transparency Performance Report
by Salvatore D'Agostino 12 Feb '25

12 Feb '25

Hi WG, Thanks to everyone who has contributed to the effort in producing this document. It was unanimously approved on our call today. It now goes to the leadership council and then 45 day public review as a Kantara Recommendation. Transparency is critical and foundational to authority, security, and privacy. It is greatly lacking from a human perspective with regards to online activity. This work looks to change that. ANCR Transparency Performance Indicators v0.9 - Google Docs<https://docs.google.com/document/d/1XF5CQH7Z4hVVqcMPZPkTjgdIP-UQum8OWDlmaS8…> Sincerely, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

Call Reminder
by gigi.agassini＠gmail.com 12 Feb '25

12 Feb '25

Dear WG, This is a reminder that we have a call tomorrow (Wednesday 29th) at 12:00 EST Call link: <https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09> https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 Agenda https://kantara.atlassian.net/wiki/spaces/WA/pages/837517332/ANCR+WG+2025012 9 * Roll Call (2m) * Agenda approval (1m) * Elections (if there are changes or unconformities with the people was nominated) (7m) * TPR (go over the document) and agreed on the publication date (40m) https://docs.google.com/document/d/1XF5CQH7Z4hVVqcMPZPkTjgdIP-UQum8OWDlmaS8K Gng/edit?tab=t.0#heading=h.phrzwpk9c5de * Adjourn (7) Kindest regards, Gigi

4 5

login.gov
by Salvatore D'Agostino 06 Feb '25

06 Feb '25

Trump, Musk, and their dangerous AI-driven government overhaul | Biometric Update<https://www.biometricupdate.com/202502/trump-musk-and-their-dangerous-ai-dr…> IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

2 1