- Wg-ancr - mailman.kantarainitiative.org

WRT TPI Report - Could it be in time for Privmas?
by Mark Lizar 12 May '25

12 May '25

Hi Sal, (everyone) Do you know if its possible to Release for May 24 - 2025? If so, perhaps we can pick up the Privmas Eve Thread ? Would anyone/everyone be interested in an Open Zoom Call - presenting the work on Monday 26th of May? If so, Maybe we can invite some of our favourite identerati, and invite parallel efforts that might find use for the TPI? e.g. - support this work contribution to efforts working in delegation, or immortal consent topics? Best, Mark Proposing Monday May 26 - (Catchy title) 10:00 am - 12:00 pm (Tentative) Agenda -(to be collaborated on) * 2025 the Year Digital Privacy Transparency Becomes a Standard? privacy transparency to scale consent (and govern surveillance /AI)? Present TPI Report * TPI Report Use Case(s) 27560 going to be open The Digital Identity Transparency Layer Landscape ? (Special Guest Speaker)

1 0

Minutes - meeting April 23rd
by Gigi Agassini 11 May '25

11 May '25

Dear ANCR WG Thank you for attending our meeting on Wednesday, April 23rd. Please find the link to the minutes, which include the key actions and discussions we covered: Meeting Minutes<https://kantara.atlassian.net/wiki/x/DQBYOg> If you notice anything missing or have any questions, please don’t hesitate to reach out. Additionally, please mark your calendars for our next Working Session on Wednesday, April 30th at 1:00 PM EST. The meeting link remains the same. Meeting Link<https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09> Looking forward to seeing you all there! Kindest Regards, Gigi Agassini

1 1

Breaking news: opportunity to present ancr work as EU ROPA replacement for SME's
by Mark Lizar 10 May '25

10 May '25

Hi All, in light of calls to update the GDPR - and make it easy for Small Business, by derogating the ROPA, record requirements for small businesses in the EU, i reached out to ask, why not implement consent receipts instead? (To the person who put consent receipts in the EU Digital Markets Act in the first place) His response was to send him an email with this as an alternative approach so that he can share this with the EU Justice Department team. As a part of my response, I would like to update them on how far the Consent Receipt work has evolved in the last 6 years into Standard Operational Transparency record information structure, that can be used for international consent record based information flows. (International Consent which was the objective of the work) Mentioning how the Kanatara Consent Receipt work was Used and is in use by industry Adopted into: ISO/IEC 27560: 2023 About to become an open standard (in 2025 Fall) Extending the open and free to access ISO/IEC 29100 - privacy framework (recently updated) TPI Benchmark for Valid Consent, coming out (next week Tbc) Conv 108+ being ratified(next month Tbc) To add to this, would there be any objections to making the ANCR Controller Identification Record. <https://kantara.atlassian.net/wiki/x/OADaNQ> Spec (On the ANCR Wiki) publicly accessible so I can include it in my response ? Best Regards, Mark Are there any objections to making the draft of the Controller Identification Record Spec publicly accessible ?

1 0

reminder TPR review call
by Salvatore D'Agostino 30 Apr '25

30 Apr '25

On now.. https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

test
by Salvatore D'Agostino 29 Apr '25

29 Apr '25

IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

TPI-R Spec, Semantic Opportunity for nnovation
by Mark Lizar 23 Apr '25

23 Apr '25

Some Notes, Wrt to today’s call, we decided to continue next week, finishing up the spec while we likely await a barrage of last minute inputs, and we havent even discussed the idea of extending the deadline. (Common practice ;-) Today, we actually accomplished work on terms, draft list now here <https://kantara.atlassian.net/wiki/x/EQDTNw> We also decided to be specific to scope of legal terms, and notice obligations that are specified legally, in particular those with regards to permission to be identified. (Of using a cookie) To this point, I invite everyone to interpret - Quebec Law 25, wherein, it references in 8.1 (quoted below) and see if there is a missing control we can add ? "any person who collects personal information from the person concerned using technology that includes functions allowing the person concerned to be identified,located or profiled must first inform the person (1) of the use of such technology; and (2) of the means available to activate the functions that allow a person to be identified, located or profiled.” The complaint for the TPR focuses online identified, (not location or profiling) and the law here indicates a control that is not opt-in, but turn on. Does this resemble an online control ? (An example would be nice) While the current T&C environment is opt-out, as it is mainly US Service based, -could this be a - turn on - identification, button? Would this also be. Notice record (in our spec), a ROPA in the EU, and a consent receipt? Best, Mark

1 0

Fw: Public Comment to the Joint Committee on Advancing Information Technology, the Internet and Cybersecurity
by Salvatore D'Agostino 22 Apr '25

22 Apr '25

________________________________ From: Salvatore D'Agostino Sent: Monday, April 14, 2025 4:56 PM To: Tricia.Farley-Bouvier(a)mahouse.gov <Tricia.Farley-Bouvier(a)mahouse.gov>; Michael.Moore(a)masenate.gov <Michael.Moore(a)masenate.gov> Cc: Daniel Schleifer <dan(a)idmachines.com>; gigi.agassini(a)gmail.com <gigi.agassini(a)gmail.com> Subject: Public Comment to the Joint Committee on Advancing Information Technology, the Internet and Cybersecurity Joint Committee on Advanced Information Technology, the Internet and Cybersecurity Chairs, Thank you for the opportunity to comment on the legislation under consideration. The ability of security and privacy professionals to apply their skills for good are greatly enhanced by the power of law. Too often security measures and privacy compliance are put in place only as a reaction to something gone wrong. The comprehensive slate of legislation here empowers better design and operation of data processing systems, and associated products and services by organizations and citizens. Massachusetts and the United States have, in the past, led the way in terms of privacy rights and frameworks. The Fair Information Practice Principles (FIPPs<https://www.fpc.gov/resources/fipps/>) that are adopted into the ISO/IEC 29100:2024<https://www.iso.org/standard/85938.html> Privacy framework from 50 years ago still apply today. It is good to see Massachusetts come back into the fight with other states across the country in enacting substantial legislation. The Kantara Initiative, where I chair a workgroup<https://kantarainitiative.org/work-groups/ancr/> on Anchored Notice and Consent Receipt, recently published for public comment a set of transparency performance indicators that can be used to measure whether there is a valid basis for consent. This legislation provides the ability to add further to legal requirements that help to define consent. S45 and H78 for example have excellent language around the requirements for consent. What exists today in too many cases are the dark patterns referenced in the legislation, provides a light to expose and change them. In the work we do we reference laws and frameworks to create security and privacy technology for people, this legislation helps. At IDmachines, we believe that there is a great opportunity for innovation when it comes to privacy and security for people. We believe this can be done in a way that benefits all stakeholders, and provide a better data economy, and that we can do that in Massachusetts. In addition to the legislation we need privacy and security infrastructure for people. While that may seem like a big dig, it in fact can be done with a fraction of the investment and provide tremendous benefits to the Commonwealth its citizens and beyond. We can create an alternative to surveillance valley that provides more useful, secure, and private digital, and real world identity, access, and mobility. The establishment of a public registry for 3rd party collecting entities could be expanded to all PII Controllers, including all covered entities in the legislation. It could include all that operate in the state of MA. It would provide sufficient information so that people could understand who they are dealing with, as could a program operating on their behalf, as to whether their status as a covered entity was in good standing, in effect the availability of a certificate of good standing, and in the case of where they are not registered in the Commonwealth, the same from the jurisdiction of their registration. In the past, I had the honor to serve as the Chair and President of the Identity Ecosystem Steering Group, a public-private partnership in cooperation with the National Institute of Standards and Technology. We published and stood up an initial registry<https://idefregistry.edufoundation.kantarainitiative.org/>. There now exists an significant opportunity, even perhaps more than before. The attached recommendation gives an example of the information that could be aggregated into controller records in that registry. It would better enable direct digital interactions between people and organizations. It is possible to go beyond managing data brokers to enabling dynamic direct data, business, and personal exchanges and reduce the need and impact of things in the middle. Respectfully, Salvatore D’Agostino IDmachines LLC 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

2 1

ANCR WG Minutes and Reminder for ANCR WG working session tomorrow
by Gigi Agassini 15 Apr '25

15 Apr '25

Dear ANCR WG. Thank you for attending Wednesday 9th's meeting. Please find the link to the minutes, which include the actions and discussions we covered: https://kantara.atlassian.net/wiki/x/MIBROQ If you notice anything missing or have any questions, please don't hesitate to reach out. This is a reminder for our ANCR WG Working session tomorrow Wednesday, April 16th at 1.00pm EST. meeting link: https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 Best regards, Gigi Agassini

1 0

FW: NEW | Privacy Framework 1.1 Initial Public Draft Release
by Salvatore D'Agostino 14 Apr '25

14 Apr '25

From: NIST Cybersecurity and Privacy Program <csrc.nist(a)service.govdelivery.com> Sent: Monday, April 14, 2025 3:07 PM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: NEW | Privacy Framework 1.1 Initial Public Draft Release <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/04/248…> View As Web Page<https://links-1.govdelivery.com/CL0/https:%2F%2Fcontent.govdelivery.com%2Fa…> <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/09/280…> NIST Cybersecurity and Privacy Program NEW | Privacy Framework 1.1 Initial Public Draft Release NIST is pleased to announce the release of the Privacy Framework 1.1 Initial Public Draft (IPD)<https://links-1.govdelivery.com/CL0/https:%2F%2Fdoi.org%2F10.6028%2FNIST.CS…>! The NIST Privacy Framework is a “living” tool meant to evolve to meet stakeholder needs, and the time has come to update to Version 1.1. This update builds on the success of Privacy Framework 1.0 by responding to current privacy risk management needs, realigning with NIST Cybersecurity Framework (CSF) 2.0, and enhancing usability. The following resources are included with the Privacy Framework 1.1 IPD release: * Privacy Framework 1.1 IPD Highlights video<https://links-1.govdelivery.com/CL0/https:%2F%2Fvimeo.com%2F1075421918%2F57…> that summarizes the development process and reviews key updates. * Mapping of Privacy Framework 1.0 Core to Privacy Framework 1.1 Core<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nist.gov%2Fdocument%2Fp…> to help organizations trace changes to Core Categories and Subcategories between Framework versions. NIST welcomes stakeholder feedback on the Privacy Framework 1.1 IPD by June 13, 2025. For more information, including a comment template and instructions for submitting feedback, please click the button below. To receive periodic updates and hear about other opportunities to engage, subscribe to our Privacy Engineering mailing list<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…>. If you have questions, please contact us at privacyframework(a)nist.gov<mailto:privacyframework@nist.gov>. Read More<https://links-1.govdelivery.com/CL0/https:%2F%2Fcsrc.nist.gov%2Fpubs%2Fcswp…> NIST Cybersecurity and Privacy Program Questions/Comments about this notice: privacyframework(a)nist.gov<mailto:privacyframework@nist.gov> Connect with us <https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.facebook.com%2FNIST/1/0…><https://links-1.govdelivery.com/CL0/https:%2F%2Ftwitter.com%2FNIST/1/010001…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.youtube.com%2FNIST/1/01…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.linkedin.com%2Fcompany%…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.instagram.com%2Fnist%2F…> Received this email from a friend? Subscribe here<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…>. <https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nist.gov%2Fitl/1/010001…> Subscriber services: Manage Preferences<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Unsubscribe<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Help<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…> _____ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…>. Technical questions? Contact inquiries(a)nist.gov<mailto:inquiries@nist.gov>. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 <https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.granicus.com…> <https://links-1.govdelivery.com/CI1/0100019635b28839-3eb0c0d8-62b7-4ac6-a21…>

1 0

Pirvacy Activity in MA
by Salvatore D'Agostino 14 Apr '25

14 Apr '25

Hi WG, There are written comments due today. I am review this fairly comprehensive set of legislation, and will share my comments with the list. I can submit these as IDmachines and mention the WG, I can also put the WG name on comments. I will try to get these out by noon. Hearing Details - Joint Committee on Advanced Information Technology, the Internet and Cybersecurity<https://malegislature.gov/Events/Hearings/Detail/5114> Also please let me know about the general WG slides. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0