- Wg-ancr - mailman.kantarainitiative.org

test
by Salvatore D'Agostino 07 Jun '24

07 Jun '24

IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com <https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

Blogpost on open standards
by Salvatore D'Agostino 06 Jun '24

06 Jun '24

0 *H÷ 010 `He0 *H÷ $}Content-Type: multipart/alternative; boundary="----=_NextPart_000_01AF_01DAB810.85457480" This is a multipart message in MIME format. ------=_NextPart_000_01AF_01DAB810.85457480 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Edit - Opening the door to digital transparency - WG - ANCR - Kantara Initiative (atlassian.net) <https://kantara.atlassian.net/wiki/spaces/WA/blog/edit-v2/507183106?draftSh areId=24dd7ad3-a92c-45bd-b095-1bfc8cede605> Based on call yesterday. So this is a wg draft, at this point please review and provide comments here to start. This is a revamp, reset of process for blog posts. Propose blog on topic by WG Create draft on wiki Review in WG Publish on wiki In this case I will also give the LC a heads up at the leadership meeting on Tuesday as well given the . As a widely distributed blog it would be better if we had Kantara backing for the ask to make this group of standards open.. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com <https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender. ------=_NextPart_000_01AF_01DAB810.85457480 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><META = HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 = (filtered medium)"><style></style></head><body lang=3DEN-US = link=3D"#467886" vlink=3D"#96607D" style=3D'word-wrap:break-word'><div = class=3DWordSection1><a = href=3D"https://kantara.atlassian.net/wiki/spaces/WA/blog/edit-v2/5071831= 06?draftShareId=3D24dd7ad3-a92c-45bd-b095-1bfc8cede605">Edit - Opening = the door to digital transparency - WG - ANCR - Kantara Initiative = (atlassian.net)</a><o:p></o:p><o:p> </o:p>Based on = call yesterday.<o:p></o:p><o:p> </o:p>So this is a = wg draft, at this point please review and provide comments here to = start.<o:p></o:p><o:p> </o:p>This is a revamp, reset of process for blog = posts… <o:p></o:p><o:p> </o:p>Propose blog on topic by WG<o:p></o:p>Create draft on wiki<o:p></o:p>Review in WG<o:p></o:p>Publish on wiki<o:p></o:p><o:p> </o:p>In this case = I will also give the LC a heads up at the leadership meeting on Tuesday = as well given the … <o:p></o:p><o:p> </o:p>As a widely = distributed blog it would be better if we had Kantara backing for the = ask to make this group of standards open..<o:p></o:p><o:p> </o:p>Best,<o:p></o:p>Sal<o:p></o:p><o:p> </o:p>IDmachines<o:p></o:p></span= >4 Lamson = Place<o:p></o:p>Cambridge, MA = 02139-2612<o:p></o:p>+1 = 617.201.4809<o:p></o:p>@idmachines<o:p></o:p></spa= n><a = href=3D"https://idmachines.com/">https://idmachines.com</a><o:p></o:p></s= pan><o:p> </o:p>Please note our new = address. Email, phones, other contacts remain the = same.<o:p></o:p><o:p> </o:p>Disclaimer<o:p></o:p>The information contained in this communication from the sender is = confidential. It is intended solely for use by the recipient and others = authorized to receive it. If you are not the recipient, you are hereby = notified that any disclosure, copying, distribution or taking action in = relation of the contents of this information is strictly prohibited and = may be unlawful. If you have received this email in error, please delete = it and advise the sender.<o:p></o:p></= span><o:p> </o:p><o:p> </o:p></div></body></html> ------=_NextPart_000_01AF_01DAB810.85457480-- ü0`0H BE#ÈDµ0 *H÷ 0J10 UUS10U IdenTrust1'0%UIdenTrust Commercial Root CA 10 140116181223Z 340116181223Z0J10 UUS10U IdenTrust1'0%UIdenTrust Commercial Root CA 10"0 *H÷ 0 §PÞ?=Ô3FñoQa²©Og]ÙSÝ(Ù×ðÿ®Crùµ]|ÁBá1PtÑ |Í!«Câ¬^nó Z2œ¢ëùè\ ìÿÒ¯q³ŽSNïŒœìO20K^WÄSÂöÙb+¿$bßÃž)KIx<`"üÚ6ÈÂ¢Ô,Tg5ns¿Xð€Ýå°¢&zÊà6¥õý·ï®?@õmZýÎ4Ê$Üt#]3]Ä%ö0Ý]àÕGœŽë¡»IIØ[óä$äbOOÁ¯tšÑrjzIÌŽFyÆ±ÚYúu!eÝVÎû«¥`ÄùR°œù+# #v;÷3áÉóiùK¢àNŒ~9÷Dp~þZå±¬ÑÌò5åIIÊVÉ=û};ÁÂMÉO7é¡jßb.Ë5Qy,È%8ôúK§\Òã 9Jt|ÕYÂ?N\Rô=÷Rñê£¬ýI4(óA:îèÞÿ_ºËèò¹P`À1ÓsåïŸ í3tŸ ÄglðzUFN§ô>áöØ á3d+c×2^ùÀ{xoŒùxz×rtUtx±ºánpºO ºhÃ{ÿ1ðs==*±A þMeky3Ž×£B0@0Uÿ0Uÿ0ÿ0UíDÀÓðî€{ŸBç&TÈ6v0 *H÷ ®2öŠK|Dva'(Í^Tï%Œãù)×®háXï..~SR¶\êºP×ßa æÎÁò7x°_³¢sž8Í>°žûÀÏ±òì--Ììª³ª`-;Ã=WužÓ0Í`ÓTñMfÀ]t@£î~ÂwèÁ§]RíÉÝ%mú©í£:4ÐY{ÚíPó5¿íëM1Ç`ôÚñâHâÆÅ7ûúuYf1G)Úvé®ï¹Q÷#ib<åU6×Tÿñ¹]ÎÔ#oØEJ[eïÝ§ Ë¥%Ž ùð¢ÒôÈt¡*HeÛÄâ%}ëŸ[ TQJSì]Ê3íbýEÇ/[ÜX 9æú×þŠí=JBtÔÃwYsÍFŸU8ïúè2êX"Þ8ÃÌŒmÉ3:j i? Èêrc#œm<àILª¢¹*6xíÃèFâ&YDuÙuQÍa`Ë]ù"Mæãö[»®ÍÊJk^óQát+é~'§ÙINø¥Û%cbÉ3gk<ÆÞšÍð7qò«üAõÁì7] åNïú±\8¥JáÜ8-<Ü«ÕJîÑplÌîôWøºn00 @žáê<zÌ>BO0 *H÷ 0:10 UUS10U IdenTrust10UTrustID CA A140 240425192606Z 260426192506Z0M1!0 *H÷ sal(a)idmachines.com1(0&UA01410C0000018F16B8E1DC00130CBB0"0 *H÷ 0 êPV_FŒÞÇYÞ»1w@ ÿÈÈr/näœ»uoBŠZ@^üÈ »wýVá!ó}gk° >:¥4:ütÅe"°³XÉº&XºðpÓ²>ºEÍ?z ¬b^5á¯ôRiÓïVOgLaèÕ².úrÑF~ÃöÕ?ô5,ËÅú2¯áâœú"EÆšŽ5õ4Åk~CP*ÒfnTnhÄÈ*£}ÞIºÝ€VÛÄTÞÄEh\8ºº ù]BÊÑÈQi1¢/vNþŠÆk'5²;6ÿËènë®0 |=£00Uÿ00Uÿ 0+x0v00+0$http://commercial.ocsp.identrust.com0B+…U#0ÂÔD qÏHVŸh8\§·÷EŒ0#U 00 g0 `Hù/0EU>0<0: 8 64http://validation.identrust.com/crl/trustidcaa14.crl0U0sal(a)idmachines.com0U6(Óqï/ØD@Ø;lmXæSE~0U%0 +0 *H÷ °`ó0Äùê2`'3V-ŠÔý.ÛvéñNF$~L/2A2õþèC(á£Ãüûdï\×î ;!)GùÓ¬NÍÏÐÖ®êòrš¥%]TaË#ÑQ÷²Ö/ªÆÛä$]IÙNØCÓ*Yµ°ôHàî+ÈŠå£ªaóòœyJl[RU*wœZºé%¹v9N6¬N}íà³so4=µ#Ü)}MÅQWãQüÊoHÖþÿ©ðMoÃŠÌ^ªê,®j³± Li;I)¡Øâ&È:÷€ôÿÕç<fëñA±°ßÙm°x~š-Çu<Îý>>U±5íkªmÀÇÏë|Ô`îMEa³©)&sGriûi=Ñïfhµîuø$ÐqÃ 6ÅÆ<A<šÄÞAr7À¢dŒÀ£0ŠbZÍ»ÄÏž.î£ú§Bì)! Ûª¬Éã#jÕäbßúätâV\1èÑÄN ÓÝÝ ^ÐGÜ]šb¹ÜÞFûn}Ácô2ŽÅ]OÝ 1ö)ÉË ."La\W!!ìRj[Ø@ðÒ{ìKÆ+ÜZ3Ù%¯Áf{"ÀË7WF¯\¬1vyÓŽÄ0ô0Ü @ÿÒiÚwÂéÕMM0 *H÷ 0J10 UUS10U IdenTrust1'0%UIdenTrust Commercial Root CA 10 230816192846Z 330812192845Z0:10 UUS10U IdenTrust10UTrustID CA A140"0 *H÷ 0 è©õŒ±éäÙËíX€ËF`eð¬ûÃA`kX»0DÙ9bÜrÁñRñÕ×«²3È÷6u/!²Öa§? Œ§8lxn×î%ûf¬<²Ñ»X$=-Ÿà§ÆÍ£EðiùëžÅFÖ{ePH»òÒßqEK tG%£¹yP2`A6ìL[Nä\ÍÒ§»Ó À[:«CQR ãL|70ídj¢Et«¹}Ì u÷@ òxb× Æ°K=°1dªØØWÐ.ïvkª r Xý(bšFr|qG Ôñ³ÿ£|\3òÚtÈ:ÒXTßŒôBp`¡Â`@±[xoÄR^.W°ö@ÁÃé7¯Ì;Œ=Us¯Ø$YÂîníºË*tÅùÛò\ oþåê'Y. xp,¬\¿åù!³I.EÛË7ï¢±ßÔh[P:4£ÿ]|×2`vZXtZ+cÒŒ~ÚÖP!!4Ó3aózG]wËí=.DÜ"X¯jë]êq?å§â!»aææVBJFQCj)(ñ" êÀÈ"©&?žR§gßû--Ùùt=µK7w¬eÀ#×k%ã3Ö)ŠÁåwsšxh:ÂÝ 8Ÿmí&Û5®i"\OŽEÝ£ä0à0Uÿ0ÿ0Uÿ0+}0{00+0$http://commercial.ocsp.identrust.com0G+0;http://validation.identrust.com/roots/commercialrootca1.p7c0U#0íDÀÓðî€{ŸBç&TÈ6v0_U X0V0TU 0L0J+>https://secure.identrust.com/certificates/policy/ts/index.html0JUC0A0? = ;9http://validation.identrust.com/crl/commercialrootca1.crl0UÂÔD qÏHVŸh8\§·÷EŒ0AU%:08++ +7 +7 +7 0 *H÷ ò][i]ãR®hÝE#+ 9q7%,Lya`VRÐÛ|ìAs«ÊœkYPÄÜdw S_ÇS¡Šá°èö(1Ü@ žæŒ&tš-B9Ì§åÚTt³Ý¿xQ¿0_¬óã°lÏ>Çc@±]NDì[£]ùb9"fkj¬ØçÀÉ¬Å»µû]5O®šªJ}ø@/Sä":MÄ ¥ÜIpÎ-'- WÌ»/MNÎŸaŒ@,µtí ¿ÛøÎxÒ]ªK'Eh2»ëô¬EØÍìÁjìñK³Ô g£JGÌüž«b]aÕ6ì·»m>Ë¡Ér"HA)ãÔ®r"Dë$\4Áìwš"0ØëQ%DœÐgëZÏ]\×¹IŽ¶l#@0â èÜ;£_àº,÷íèjA=UéOÆ0üôÈÖAg!Y6 ô*s!YTÉŒ¿é©J^íxàÝN}ý+Š°L%Rmü?â/[ìs$ßÃÿeZ((ôjdÓ±x*EB;2SšDåêìÄXyÈÍÏ3ké/ÒysáÎZªf²žÍ~º£±}EÐ*)K]b8NU¢f1<080N0:10 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0 `He ¿0 *H÷ 1 *H÷ 0 *H÷ 1 240606165325Z0/ *H÷ 1" ÎO^eÄ ºáLdydaq6_/Þ°^â¢30] +71P0N0:10 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0_*H÷ 1P N0:10 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0 *H÷ 100 `He*0 `He0 *H÷ 0 `He0*H÷ 0 *H÷ @0 `He0 `He0 `He0+0 *H÷ ëR!éûÃÐ§tæò4jdµ)ØP#[%Hí/œíáSÁçò²¥&| TÇëÕÏÇì)L,åÚØ·Å·û©+[kÖpÊäTŠõÿ£Ý³Ñ%qfJ]ýú9Õ|Â®Ôš»[NA)ýÀä¬ 8Ce¢8¢è®?Ú:&Öc§päÊË>ësÇËcguóé)»PNüAµd0,/ªèícªL)Fuxotn©TÒwÅÞÈÅyþÜ±JÈïl¢ šî|/åÙSQË DzÂÌ0/t?;Tõa÷ÂH#š¹

1 0

ANCR WG - The request for ISO/IEC 29184 Online privacy notice and consent to be free to access
by Mark Lizar 05 Jun '24

05 Jun '24

Dear Leadership Council, Your support of the request for ISO/IEC 29184 Online privacy notice and consent to be free to access The ANCR WG had a motion to support request for 29184 to free to access. As it is now the security and privacy controls in 29184 for notices are not available for the consent record framework in ANCR. This is why the ANCR WG motioned to support the request for 29184 to made open and to make it clear, that there is great demand, and even an urgent need for standardized digital transparency and Consent by Design. ANCR WG has identified a clear gap in trust of digital identity management driving demand for standards that enable people to manage their own digital identity and security risks. In this regard, an important request was made during the recent plenary in Manchester, UK: to make the ISO/IEC 29184 Online privacy notice and consent standard to be free to access. As our work on the Consent Receipt was specified to supplement this standard, without it bing free to access, we would not be able to directly use it. In addition, as this standard specifies transparency, it has a great value for the Consent by Design work at the ANCR WG. In fact, 29184 would provide excellent benchmarking criteria for regulators and policy makers, and with support of Kantara community we could make it possible for this consent work to fulfil its purpose of addressing misinformation in security, digital identity, AI and personal media management technology. For this purpose, on 28 May, I sought assistance from Canada’s National Mirror Committee for ISO/IEC in this effort. Below you can find a summary of my argument for doing so. Now we ask if the LC, and Kantara community will join in supporting this effort through the ISO/IEC liaison. You would not only be furthering our shared goal of enhancing digital privacy and transparency but also moving towards ensuring transparency and trust in digital identity practices worldwide. A topic in which there broad and growing consensus on, Thank you for your consideration. Mark / ANCR WG Why open access matters 29184 was developed to supplement the freely accessible ISO/IEC 29100 security and privacy techniques framework. Our work at the Kantara Initiative has long focused on standardizing notice to enable managed consent and control over data access on a large scale. This effort began more than a decade ago at the W3C - Do Not Track and Beyond conference, where Ashkan Soltani, Reuben Bins, and I presented on the need for notice and transparency standards in online security and privacy<https://www.w3.org/2012/dnt-ws/position-papers/23.pdf>. The business case for standardizing digital transparency There is a compelling business case for ISO/IEC to lead in standardizing digital transparency for security, privacy, and digital identity management. A robust set of international transparency standards would compel industries to adopt ISO/IEC’s paid security standards, such as 27001, 27002, and 27701. These standards provide specific requirements and guidance for establishing a Privacy Information Management System (PIMS). Acting now to facilitate data governance and security interoperability will enable ISO/IEC to lead this competitive practice internationally. International impact and interoperability Our commitment to this project is driven by 29100’s influence in developing international privacy instruments that are interoperable with GDPR and, importantly for Canada, the CoE Convention 108+. Expected to be ratified by 2025 latest, Convention 108+ will provide Canada with an international data governance instrument for security and privacy across the Commonwealth, encompassing 56 countries and 2.5 billion people. Convention 108+ mirrors the GDPR Chapter 1 Transparency Modalities section, and 29100 has been the only international standard we can use to create an international transparency standard that scales consent with identity management internationally. The implications for Kantara Last August, ISO/IEC 27560 Consent Record Information Structure was published, derived from the Kantara Consent Receipt V1.1 specification. This specification was designed to supplement both 29100 and 29184. When 29184 was published, the Consent Notice Receipt was included in Appendix B. Consequently, our work at Kantara on notice and consent receipts can contribute as a regulatory tool to assess the conformance and compliance of PII Controller notice records and credentials, benchmarking compliance with 29184 natively. In our ANCR WG, we developed a Transparency Performance Scheme for creating conformant PII Controller records, as a legal record of processing to assess the performance of transparency and legal validity of consent. To further this work and utilize 29184 for it to support an international standard for digital privacy transparency and consent (notice record and receipts), it, along with ISO/IEC 27560 consent record information structure must be open and freely available to use for public digital infrastructure.

1 0

Request for 29184 to be made free to access submitted
by Mark Lizar 03 Jun '24

03 Jun '24

Hi ANCR’s, I have just submitted this request to ISO/IEC Mirror Committee, here is the requests - (without the form) for your review, and perhaps with ANCR Consensus on this topic ANCR WG can support this too? What do you think @Sal? Kind Regards, Mark **** Dear JTC1 / SC 27 / WG5 Mirror Committee, During the plenary in Manchester UK a request to make ISO/IEC 29184 Online privacy notice and consent standard free to access. First and foremost this is a transparency standard for online privacy notice which if not open defeats the purpose of the standard, which can be used to address mis-information in security and digital identity management technology. 29184 was made to supplement the free to access ISO/IEC 29100 security and privacy techniques framework and it has been a long term focus of the work at the Kantara Initiative, with the mission of standardizing notice to enable consent to managed control and access to data scale online. This effort began in 2012 with a call to action for notice and transparency standards for security and privacy online at a W3C - Do Not Track and Beyond conference, where Ashkan Soltani, Reuben Bins and I presented on this topic<https://www.w3.org/2012/dnt-ws/position-papers/23.pdf>. There is a clear business case for ISO/IEC to standardize digital transparency for security, privacy and digital identity management, as a successful international transparency set of standards would more aggressively onboard industries into ISO/IEC paid security standards. 27001, 27002, and 27701 which provides specific requirements and implementation guidance for establishing a Privacy Information Management System (PIMS). Enabling data governance and security interoperability is competive practice which ISO/IEC obviously wants to lead internationally in. The reason we chose this project and work was because ISO/IEC 29100 has driven the development of international privacy instruments, and is interoperable with GDPR and more importantly for Canada, CoE Convention 108+ which is expected to be ratified in 2024 or 2025. Providing Canada with an international data governance instrument for security and privacy across the commonwealth containing 56 countries and 2.5 Billion people. Convention 108+ mirrors the GDPR Chapter 1 Transparency Modalities section and ISO/IEC 29100, as a free to access standard, has been the only international standard which we can use to make an international transparency standard to scale consent with identity management internationally. . Background The standard published last August, ISO/IEC 27560 consent record information structure, was developed from the Kantara Consent Receipt V1.1 specification, which was written to supplement both 29100 and 29184 Online privacy notice and consent standard. When 29184 was published the Consent notice receipt, was published in the Appendix B, and as a result, our notice and consent receipt work at Kantara could be contribute as a regulatory tool to asses conformance and compliance of PII Controller notice records and credentials, which could then be used to benchmark compliance with 29184 natively. In the ANCR WG we have a Transparency performance scheme, for making conformant records of processing and for assessing if consent is valid or not. In order to further this work or to utilize 29184 to support an international standard for digital privacy transparency and consent (aka notice record and receipts) it must be open and freely available to be use and specify with. To this end, I humbly ask for this committees's support of this request to make ISO/IEC 29184 Online privacy notice and consent standard open and free to access . Best Regards, Mark Lizar

2 7

Reminder: 0PN-ANCR Call tomorrow
by Mark Lizar 28 May '24

28 May '24

A reminder that we have a 0PN - ANCR Call tomorrow, Besides a list of things to do, the aim is to also discuss the Transparency Index Service to Demo the ANCR specifications, and to use the TPS Scheme to show the state of valid consent in digital identity systems. Does anyone object to using the same zoom # but for 0PN Trust Framework Call tomorrow? Mark

1 0

ANCR Blog - With New Video Link & Blog - Re: Vimeo link from April 11, Manchester
by Mark Lizar 26 May '24

26 May '24

Hi All, (thanks Tim and Tara) It took a bit of working on compressing the video. Hopefully not too much. I had to install compression software, compress the video, and then on the 3rd attempt, I had to verify with google to upload a vid longer than 15 min, (Arg. This means sending my ph to the USA with my profile so I can be ‘verified') Finally, these have been added in the ANCR Blogs; one on Consent by Design with Standard Digital Privacy Transparency on the ANCR Wiki<https://kantara.atlassian.net/wiki/x/eQAvHQ>. As well as the first report to JTC 1 Committee<https://kantara.atlassian.net/wiki/x/lgAvHQ>. Next report to them is on Addressing ethics and governance in generative AI with Standardized Digital Privacy Transparency, and then a request to them for making ISO/IEC 29184 Online privacy notice and consent open and free to access. The ANCR TPS Scheme could then be used to benchmark compliance (not just conformance) against this standard. All feedback is welcome of course, (thanks for that so far Sal) I will give it another edit and polish Mark <https://youtu.be/QrJnFJFuv3g> youtu.be<https://youtu.be/QrJnFJFuv3g> [X]<https://youtu.be/QrJnFJFuv3g>

1 0

ANCR Blog & ISO Committee Report - Re: Report Author / Editors needed
by Mark Lizar 25 May '24

25 May '24

Hi Sal, (Everyone) ( I am moving this great thread to ANCR WG mailing list) The ANCR Post Digital Transparency for Consent by Design<https://kantara.atlassian.net/wiki/pages/resumedraft.action?draftId=4896195…> is now up on ANCR - with what feels like a very strong consensus. The report to ISO Committee Report<https://kantara.atlassian.net/wiki/pages/resumedraft.action?draftId=4896196…> (and Transparency Index Project Overview<https://kantara.atlassian.net/wiki/pages/resumedraft.action?draftId=4896196…>) is now moved to Kantara Wiki, but from what I can tell only Sal and Gigi are signed up to Kantara Wiki, so I have been able to give you both (Sal and Gigi) access. Marcelle, Dan, Tim, Tara, Gaz, Tregon, Shankar et al, you would need to subscribe<https://kantarainitiative.org/mailman/listinfo/wg-ancr> to this wiki (it’s free) if you would like to see what is restricted from public view and work on the Transparency Index with us. Happy Jedi Privacy Day, Mark (commemorating the day GDPR was implemented in the EU) PS Sal - Again, I am not 100% sure which doc you are referring too, On May 25, 2024, at 9:48 AM, Salvatore D'Agostino <sal(a)idmachines.com> wrote: Can we start with why instead of what? Who is the audience? Why this matters to them?

1 0

Updates & The Digital Transparency Blog
by Mark Lizar 22 May '24

22 May '24

Hi All, We had a tremendously productive call today, first we have in formally agreed to add specifying the ANCR Consensus Protocol and processes as a core activity and piece of work will do on the calls, in addition to receiving and discussing updates, and maintaining the work group admin and roadmap. Proposing that we work on Consensus protocol each bi-weekly call focusing on terms of process in a specification document, and then we try working with and on the consensus protocol via GitHub. With this clarity of the ANCR work and purpose really starts to come into focus. It’s my tasks to get things going in this regard, with an action for the initial docs by next meeting. The first point of consensus we are looking to drive and comment on is the first blog post <https://kantara.atlassian.net/wiki/pages/resumedraft.action?draftId=4810670…> (due Tomorrow) and then the list of short blog posts which is in the ANCR - Kantara Github. <https://github.com/KantaraInitiative/WG-ANCR/discussions/21#discussion-6713…> Please review and comment on these two items in order to drive my editing and content delivery. @Sal, please start from here - / continue from here with the slide for Kay (as actioned on the call) Kind Regards, Mark

1 0

Plurality: The Future of Collaborative Technology and Democracy
by Salvatore D'Agostino 21 May '24

21 May '24

https://www.plurality.net/ Get Outlook for iOS<https://aka.ms/o0ukef>

2 1

Re: Event Updated: DPVCG Meeting Call 15 May 2024
by Mark Lizar 16 May '24

16 May '24

Hi Iain, Thats great idea. We are and have been working on this for years, and have the consent receipt v2, with consent token specification. Essentially, the piece I would really enjoy working out / discussing with this group is finishing purpose specification for the 6 legal justifications, as the purposes defined somewhat by this. In addition, 3 to 4 years ago, I presented the types of consent, mapped to legal justification and the rights to this group. But at this time it was not considered by DPV. Whats even more interesting now is that we have the approach of Consent by Design, which is effectively about digital transparency for security and privacy interoperability (or digital privacy for short) which requires a receipt and record, just like in banking. In consent by design - all the notice, notification and disclosures are specified semantically to be from the consent, a protocol we are calling AuthC - which is authentication from consent. It doesnt matter what the legal justification is, the transparency modality and semantics are always human centric and from the capture of real consent. In this regard, its is the notice and the action of the individual ands the context that defines the purpose. In this way consent is captured, as long as it complies with transparency modalities. To which we have identified 23 transparency notice, notification and disclosure requirements in the GPDR which are required depending on the legal justification. The Kantara Transparency Performance Scheme<https://kantara.atlassian.net/wiki/x/O4P5EQ> is what is used to assess whether or not the consent is legally valid. The way it works is really simple. The PII Controller record <https://kantara.atlassian.net/wiki/spaces/WA/pages/312378386/ANCR+0PN-TFP+-…> (not consent record) is linked to any notice or sign with the Signalling icon, (AKA the consent gateway for privacy as expected) the notice and the semantics are specified using ISO/IEC 29100 and the DPV, the PII Principle clicks on the I accept button, and the controller credential is used to generate a notice record and consent/notice receipt, which provides legal proof of notice, aka proof of knowledge. The reason we call it a consent receipt is that this receipt can then be used to direct consent for a secondary purpose, regardless of the legal justification, independent of the provider. This has immense benefits in multiple ways especially for data governance, it is the Law in Quebec Canada. Just like receipts working currency banking, works the same for knowledge banking. It’s getting really fun now, after addressing some these really puzzling challenges that have stumped us in the past. Happy to contribute this to and support this work I. DPV Best, Mark On May 16, 2024, at 2:46 AM, Iain Henderson <iain(a)jlinc.com> wrote: Hi Mark, I see where you are coming from and agree. This issue has been noted previously, and I have taken the action to come up with a proposed ‘human’ extension for DPV that introduces that lens that is oriented for a reader / user of DPV (or an agent acting on their behalf) to have a framing of specific that works for them. Happy to have you contribute that if you think that works? Cheers Iain On 16 May 2024, at 06:14, Mark Lizar <mark(a)openconsent.com> wrote: Simply put, Consent is provisioned from the individual — it’s from a person - the semantics must reflect this. While the standard might say consent record, in reality it is a record of notice, which provides proof of knowledge that give the legal evidence of consent. So ‘obtain consent<https://github.com/w3c/dpv/issues/115#issuecomment-1793416931>’ is not correct semantic as this would be obtain permission, The trouble with enterprise type of legal perspective is that the semantics are all interpreted from the institutional perspective in DPV, while consent in law is acutally human legal perspective. This means consent comes from people, it’s not a something is too someone - e.g. obtained from them. It could be ‘provided’ or it could be captured, indicated through action, but only if is informed in accordance with Chapter 1 Transparency Modalities in GDPR. Does this help? Mark On May 15, 2024, at 10:05 AM, Harshvardhan Pandit <me(a)harshp.com> wrote: Hi Mark. I have the same understanding - and I am not disagreeing with you - but I don't understand what you're asking here (sorry). What do you - specifically - want to add or change or remove from DPV? DPVCG does not make requirements for how things work - we provide a specification for representation of information for requirements that come from e.g. law or standards. On 15/05/2024 14:54, Mark Lizar wrote: Hi Harsh, Consent is human and legally defined, and this is how it is defined in law. Both must be considered. Systems manage permissions, human manage consent, and consent is implied through the purpose of an action. Most importantly, consent can only be provided if there is sufficient transparency, it is not something that happens independent of notice. For consent to be valid, the identity of the controller must first be provided, or else consent cannot be provided. - Mark On 15 May 2024, at 09:26, Harshvardhan Pandit <me(a)harshp.com> wrote: Hi Mark. We are modelling consent as defined in laws and legal terminology. From the perspective of the individual, they 'provide' consent. From the perspective of the organisation, they 'obtain' (or collect) consent. I don't think we are conflating consent and permissions. On 15/05/2024 14:22, Mark Lizar wrote: Hi All, There is a huge issue in that Consent and Permission are very confused. Systems obtain permission, permission is given, all of which can happen with out the consent or consensus of the individual. The semantics are incredibly important, as the dark patterns in the identity management is a significant problem. Best, Mark On 15 May 2024, at 09:05, Mark Lizar <mark(a)openconsent.com> wrote: Hi Harsh, Consent is provided not obtained, On 14 May 2024, at 16:10, Harshvardhan J. Pandit (W3C Calendar) <noreply+calendar(a)w3.org> wrote: View this event in your browser <https://www.w3.org/events/meetings/0f0fbb7f-df36-4325-b39b-60e0eac5c8b7/202…<https://www.w3.org/events/meetings/0f0fbb7f-df36-4325-b39b-60e0eac5c8b7/202…>> DPVCG Meeting Call 15 May 2024 ^Upcoming ^Confirmed 15 May 2024, 14:00 -15:00 Europe/Dublin Event is recurring weekly on Wednesday, starting from 2024-04-24, until 2024-12-19 Data Privacy Vocabularies and Controls Community Group <https://www.w3.org/groups/cg/dpvcg/calendar/<https://www.w3.org/groups/cg/dpvcg/calendar/>> This is the weekly DPVCG meeting call Agenda Agenda <https://www.w3.org/events/meetings/0f0fbb7f-df36-4325-b39b-60e0eac5c8b7/202…<https://www.w3.org/events/meetings/0f0fbb7f-df36-4325-b39b-60e0eac5c8b7/202…>> Previous minutes:https://w3id.org/dpv/meetings/meeting-2024-05-08<https://w3id.org/dpv/meetings/meeting-2024-05-08><https://w3id.org/dpv/meetings/meeting-2024-05-08<https://w3id.org/dpv/meetings/meeting-2024-05-08>> This meeting will be chaired by Beatriz with apologies from Harsh To confirm issue can be closed: (the text will be updated after concepts are finalised) * justifications:https://github.com/w3c/dpv/issues/83<https://github.com/w3c/dpv/issues/83> <https://github.com/w3c/dpv/issues/83<https://github.com/w3c/dpv/issues/83>> see live: https://harshp.com/dpv/justifications/<https://harshp.com/dpv/justifications/> <https://harshp.com/dpv/justifications/<https://harshp.com/dpv/justifications/>> * statuses for involved, intention, entity informed: https://github.com/w3c/dpv/issues/116<https://github.com/w3c/dpv/issues/116> <https://github.com/w3c/dpv/issues/116<https://github.com/w3c/dpv/issues/116>> see live: * human involvement and automatino: https://github.com/w3c/dpv/issues/108<https://github.com/w3c/dpv/issues/108> <https://github.com/w3c/dpv/issues/108<https://github.com/w3c/dpv/issues/108>> see live: https://harshp.com/dpv/dpv/#vocab-context-status<https://harshp.com/dpv/dpv/#vocab-context-status> <https://harshp.com/dpv/dpv/#vocab-context-status<https://harshp.com/dpv/dpv/#vocab-context-status>> * Tech extension - dropped prefix 'Technology' from actors: https://github.com/w3c/dpv/issues/142<https://github.com/w3c/dpv/issues/142> <https://github.com/w3c/dpv/issues/142<https://github.com/w3c/dpv/issues/142>> * Tech extension - added cloud concepts, status, docs, removed categories:https://github.com/w3c/dpv/issues/47<https://github.com/w3c/dpv/issues/47> <https://github.com/w3c/dpv/issues/47<https://github.com/w3c/dpv/issues/47>> * AI Act add Prospective Provider: https://github.com/w3c/dpv/issues/146<https://github.com/w3c/dpv/issues/146> <https://github.com/w3c/dpv/issues/146<https://github.com/w3c/dpv/issues/146>> * added GDPR principles, see live: https://harshp.com/dpv/legal/eu/gdpr/#vocab-principles<https://harshp.com/dpv/legal/eu/gdpr/#vocab-principles> <https://harshp.com/dpv/legal/eu/gdpr/#vocab-principles<https://harshp.com/dpv/legal/eu/gdpr/#vocab-principles>> (fyi, confirm its okay) To discuss: * measures for consent obtain, withdraw etc.: https://github.com/w3c/dpv/issues/115<https://github.com/w3c/dpv/issues/115> <https://github.com/w3c/dpv/issues/115<https://github.com/w3c/dpv/issues/115>> - added controls for consent, see live: https://harshp.com/dpv/dpv/#vocab-legal-basis-consent-controls<https://harshp.com/dpv/dpv/#vocab-legal-basis-consent-controls> <https://harshp.com/dpv/dpv/#vocab-legal-basis-consent-controls<https://harshp.com/dpv/dpv/#vocab-legal-basis-consent-controls>> * Express 'goal' or 'purpose' of technology - https://github.com/w3c/dpv/issues/85<https://github.com/w3c/dpv/issues/85> <https://github.com/w3c/dpv/issues/85<https://github.com/w3c/dpv/issues/85>>, see https://lists.w3.org/Archives/Public/public-dpvcg/2024May/0002.html<https://lists.w3.org/Archives/Public/public-dpvcg/2024May/0002.html><https://lists.w3.org/Archives/Public/public-dpvcg/2024May/0002.html<https://lists.w3.org/Archives/Public/public-dpvcg/2024May/0002.html>> proposing tech:hasIntendedUse Reminder: * DPV v2 release schedulehttps://github.com/w3c/dpv/milestone/4<https://github.com/w3c/dpv/milestone/4> <https://github.com/w3c/dpv/milestone/4<https://github.com/w3c/dpv/milestone/4>> Help wanted: * update README.md and docs -https://github.com/w3c/dpv/issues/144<https://github.com/w3c/dpv/issues/144> <https://github.com/w3c/dpv/issues/144<https://github.com/w3c/dpv/issues/144>> * add profile metadata to dpv rdf - https://github.com/w3c/dpv/issues/141<https://github.com/w3c/dpv/issues/141> <https://github.com/w3c/dpv/issues/141<https://github.com/w3c/dpv/issues/141>> * review contents (when ready) - https://github.com/w3c/dpv/issues/127<https://github.com/w3c/dpv/issues/127> <https://github.com/w3c/dpv/issues/127<https://github.com/w3c/dpv/issues/127>> AOB Joining Instructions Join the meeting <https://dcu-ie.zoom.us/j/92216714069?pwd=NUIrZWFmWDF0bExhU3V2ak43L3lrUT09 <https://dcu-ie.zoom.us/j/92216714069?pwd=NUIrZWFmWDF0bExhU3V2ak43L3lrUT09>> Participants Groups * Data Privacy Vocabularies and Controls Community Group <https://www.w3.org/groups/cg/dpvcg/<https://www.w3.org/groups/cg/dpvcg/>> (View Calendar <https://www.w3.org/groups/cg/dpvcg/calendar/<https://www.w3.org/groups/cg/dpvcg/calendar/>>) Report feedback and issues on GitHub <https://github.com/w3c/calendar<https://github.com/w3c/calendar>>. To stop receiving these emails please update your calendar preferences <https://www.w3.org/users/myprofile/calendar/preferences/<https://www.w3.org/users/myprofile/calendar/preferences/>>. <event.ics> -- --- Harshvardhan J. Pandit, Ph.D Assistant Professor ADAPT Centre, Dublin City University https://harshp.com/<https://harshp.com/> -- --- Harshvardhan J. Pandit, Ph.D Assistant Professor ADAPT Centre, Dublin City University https://harshp.com/

1 0