Re: Next Steps - Notice and Consent Receipt v2,
Dear WG, There has been some good forward movement on resolving long outstanding issues in advancing the work from the ANCR WG. Below I explain why I would like to propose that we take our v2 notice and consent receipt work to Data Governance Standards Institute (DGSI), a Canadian national standards body, as soon as possible. For those of you who don’t know, there are some known challenges to progress the notice and consent receipt work. In summary: * Originally called the MVCR [Minimum Viable Consent Receipt], it was taken too soon to ISO and named 27560 Consent record information structure, without the CISWG’s knowledge * At ISO, it was politicised and diluted by numerous national inputs until it was unable to address the core issues of notice and consent * Consent requires open and standard transparency; its strength, integrity and viability depend on it. This is why the MVCR is a notice receipt, that anyone can use to consent with, Consent is essentially based on a notice record information structure, which is what ISO/IEC 29184 is focused on, as well as some very specific laws,. able to be used autonomously to demonstrate consent * It was specified to the ISO/IEC 29100 security and privacy framework which was open, but its latest update is not * It was specified for ISO/IEC 291284 Online Privacy notice and consent standard, (see Appendix D 29184). This standard is not open (exclusive), so not operational as a international transparency and identity governance standard * Finally, 27560 the consent record information structure makes a fundamental error by confusing consent (managed by humans) with permission (managed by services) * Whats more, continuing this work via Kantara has a dis-advantage, As Kantara is not a national standard body, making a Special Interest Group, for Authc with members from national stakeholder a non viable path. For these reasons and more, the ANCR WG has always been viewed as a place to incubate standards for industry and regulatory use. This is why we have worked on a companion TP-Scheme that uses this specification to demonstrate conformance and compliance. The idea being that we, the ANCR WG, work on the scheme, and support its use and extension for a Kantara programme, or one that Kantara collaborates with. The ANCR WG demo, in collaboration with a specification at DGS is what is ultimately being proposed here as the immediate path forward DGSI are now recognised, accredited to make national and international standards, and have a direct route to ISO/IEC. Even more importantly, DGSI have an arrangement with ISO because their standards are open, the standards put forward to ISO will also be free and open to access. This provides us with a clear path for our v2 Notice and Consent specification to ISO, with national regulatory input, at no cost. To this end, the next plenary for ISO is coming up at the end of this month and comment is needed next week (w/c 9 September). I suggest we put forward to the 27560 that we have a proposed v2 to be developed in collaboration with DGSI, and that we have a TPS at Kantara, to assess validity of consent, Suggesting We move the TP-Scheme forward in this context - and from this context work on the AuthC SiG. Please comment and respond before next weeks meeting (Wed 12th of September) - Mark
Dear Mark, The opportunity with DGSI, the upcoming ISO meeting, and the need to complete the publications on our roadmap, requires us to focus on these projects/publications to take advantage of this. The direction below does not change the work or the direction of what we have underway. In all cases we need to finalize the scope and get out the TPI/TPS, and CRv2. I suggest that we use the majority of the meeting to assess where we are at, and what we commit to accomplishing. Sincerely, Sal From: Mark Lizar <mark@transparencylab.ca> Sent: Thursday, September 5, 2024 11:45 PM To: wg-ancr@kantarainitiative.org Subject: [WG-ANCR] Re: Next Steps - Notice and Consent Receipt v2, Dear WG, There has been some good forward movement on resolving long outstanding issues in advancing the work from the ANCR WG. Below I explain why I would like to propose that we take our v2 notice and consent receipt work to Data Governance Standards Institute (DGSI), a Canadian national standards body, as soon as possible. For those of you who don’t know, there are some known challenges to progress the notice and consent receipt work. In summary: * Originally called the MVCR [Minimum Viable Consent Receipt], it was taken too soon to ISO and named 27560 Consent record information structure, without the CISWG’s knowledge * At ISO, it was politicised and diluted by numerous national inputs until it was unable to address the core issues of notice and consent * Consent requires open and standard transparency; its strength, integrity and viability depend on it. This is why the MVCR is a notice receipt, that anyone can use to consent with, Consent is essentially based on a notice record information structure, which is what ISO/IEC 29184 is focused on, as well as some very specific laws,. able to be used autonomously to demonstrate consent * It was specified to the ISO/IEC 29100 security and privacy framework which was open, but its latest update is not * It was specified for ISO/IEC 291284 Online Privacy notice and consent standard, (see Appendix D 29184). This standard is not open (exclusive), so not operational as a international transparency and identity governance standard * Finally, 27560 the consent record information structure makes a fundamental error by confusing consent (managed by humans) with permission (managed by services) * Whats more, continuing this work via Kantara has a dis-advantage, As Kantara is not a national standard body, making a Special Interest Group, for Authc with members from national stakeholder a non viable path. For these reasons and more, the ANCR WG has always been viewed as a place to incubate standards for industry and regulatory use. This is why we have worked on a companion TP-Scheme that uses this specification to demonstrate conformance and compliance. The idea being that we, the ANCR WG, work on the scheme, and support its use and extension for a Kantara programme, or one that Kantara collaborates with. The ANCR WG demo, in collaboration with a specification at DGS is what is ultimately being proposed here as the immediate path forward DGSI are now recognised, accredited to make national and international standards, and have a direct route to ISO/IEC. Even more importantly, DGSI have an arrangement with ISO because their standards are open, the standards put forward to ISO will also be free and open to access. This provides us with a clear path for our v2 Notice and Consent specification to ISO, with national regulatory input, at no cost. To this end, the next plenary for ISO is coming up at the end of this month and comment is needed next week (w/c 9 September). I suggest we put forward to the 27560 that we have a proposed v2 to be developed in collaboration with DGSI, and that we have a TPS at Kantara, to assess validity of consent, Suggesting We move the TP-Scheme forward in this context - and from this context work on the AuthC SiG. Please comment and respond before next weeks meeting (Wed 12th of September) - Mark
Hi Sal, (ANCR WG) Thanks for tea’ing this up. The challenges to completing work, which we have discussed at length through submissions of proposals for funding, are addressed if we collaborate with DGSI, move the CR V2 work there, and then update the TP-Scheme. 27560, which is now chaired by Jan and Harsh, has a new number 27569, to add the other legal justifications to the 27560 standard. The aim is to submit a comment from ANCR, to ISO as well as via the Canadian SC27 Mirror Committee, that KI ANCR WG, is collaborating with DGSI, to submit a draft update to 27560, for 27569. Perhaps we can add something towards, addressing roles, distinguishing permission from consent, not identifying the individual be default, but making this the choice of the PII principal, with personal data control. Specified specifically to Conv 108+ - (which is mirrored by GDPR) to address Article - 13-17, 31 and 88. The so that the spec can be used by other standards to demonstrate compliance with these Articles. I am talking with Jan and Harsh about this, this week, and intend to virtualy attend the meeting for this at the end of the month. Ideally, we can approve a) the contribution and collaboration with DGSI , b) the ANCR comment submitted to Canadian Mirror Committee, and subsequently ISO for the next meeting, (aka by the end of the next week. Can you add these to the agenda? I will aim to get drafts over to the work group, asap. Best, Mark On 6 Sep 2024, at 09:31, Salvatore D'Agostino <sal@idmachines.com> wrote: Dear Mark, The opportunity with DGSI, the upcoming ISO meeting, and the need to complete the publications on our roadmap, requires us to focus on these projects/publications to take advantage of this. The direction below does not change the work or the direction of what we have underway. In all cases we need to finalize the scope and get out the TPI/TPS, and CRv2. I suggest that we use the majority of the meeting to assess where we are at, and what we commit to accomplishing. Sincerely, Sal From: Mark Lizar <mark@transparencylab.ca> Sent: Thursday, September 5, 2024 11:45 PM To: wg-ancr@kantarainitiative.org Subject: [WG-ANCR] Re: Next Steps - Notice and Consent Receipt v2, Dear WG, There has been some good forward movement on resolving long outstanding issues in advancing the work from the ANCR WG. Below I explain why I would like to propose that we take our v2 notice and consent receipt work to Data Governance Standards Institute (DGSI), a Canadian national standards body, as soon as possible. For those of you who don’t know, there are some known challenges to progress the notice and consent receipt work. In summary: * Originally called the MVCR [Minimum Viable Consent Receipt], it was taken too soon to ISO and named 27560 Consent record information structure, without the CISWG’s knowledge * At ISO, it was politicised and diluted by numerous national inputs until it was unable to address the core issues of notice and consent * Consent requires open and standard transparency; its strength, integrity and viability depend on it. This is why the MVCR is a notice receipt, that anyone can use to consent with, Consent is essentially based on a notice record information structure, which is what ISO/IEC 29184 is focused on, as well as some very specific laws,. able to be used autonomously to demonstrate consent * It was specified to the ISO/IEC 29100 security and privacy framework which was open, but its latest update is not * It was specified for ISO/IEC 291284 Online Privacy notice and consent standard, (see Appendix D 29184). This standard is not open (exclusive), so not operational as a international transparency and identity governance standard * Finally, 27560 the consent record information structure makes a fundamental error by confusing consent (managed by humans) with permission (managed by services) * Whats more, continuing this work via Kantara has a dis-advantage, As Kantara is not a national standard body, making a Special Interest Group, for Authc with members from national stakeholder a non viable path. For these reasons and more, the ANCR WG has always been viewed as a place to incubate standards for industry and regulatory use. This is why we have worked on a companion TP-Scheme that uses this specification to demonstrate conformance and compliance. The idea being that we, the ANCR WG, work on the scheme, and support its use and extension for a Kantara programme, or one that Kantara collaborates with. The ANCR WG demo, in collaboration with a specification at DGS is what is ultimately being proposed here as the immediate path forward DGSI are now recognised, accredited to make national and international standards, and have a direct route to ISO/IEC. Even more importantly, DGSI have an arrangement with ISO because their standards are open, the standards put forward to ISO will also be free and open to access. This provides us with a clear path for our v2 Notice and Consent specification to ISO, with national regulatory input, at no cost. To this end, the next plenary for ISO is coming up at the end of this month and comment is needed next week (w/c 9 September). I suggest we put forward to the 27560 that we have a proposed v2 to be developed in collaboration with DGSI, and that we have a TPS at Kantara, to assess validity of consent, Suggesting We move the TP-Scheme forward in this context - and from this context work on the AuthC SiG. Please comment and respond before next weeks meeting (Wed 12th of September) - Mark _______________________________________________ A Community Group mailing list of KantaraInitiative.org<http://kantarainitiative.org/> Wg-ancr mailing list -- wg-ancr@kantarainitiative.org<mailto:wg-ancr@kantarainitiative.org> To unsubscribe send an email to staff@kantarainitiative.org<mailto:staff@kantarainitiative.org> List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-ancr@kantarainitiat... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/Wg-ancr
0 *H÷ 010 `He0 *H÷ $ Content-Type: multipart/alternative; boundary="----=_NextPart_000_001F_01DB0049.494AE7E0" This is a multipart message in MIME format. ------=_NextPart_000_001F_01DB0049.494AE7E0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Yes, I can start a draft agenda and include this. From: Mark Lizar <mark@transparencylab.ca> Sent: Friday, September 6, 2024 10:23 AM To: Salvatore D'Agostino <sal@idmachines.com> Cc: wg-ancr@kantarainitiative.org Subject: Re: [WG-ANCR] Next Steps - Notice and Consent Receipt v2, Hi Sal, (ANCR WG) Thanks for teaâing this up. The challenges to completing work, which we have discussed at length through submissions of proposals for funding, are addressed if we collaborate with DGSI, move the CR V2 work there, and then update the TP-Scheme. 27560, which is now chaired by Jan and Harsh, has a new number 27569, to add the other legal justifications to the 27560 standard. The aim is to submit a comment from ANCR, to ISO as well as via the Canadian SC27 Mirror Committee, that KI ANCR WG, is collaborating with DGSI, to submit a draft update to 27560, for 27569. Perhaps we can add something towards, addressing roles, distinguishing permission from consent, not identifying the individual be default, but making this the choice of the PII principal, with personal data control. Specified specifically to Conv 108+ - (which is mirrored by GDPR) to address Article - 13-17, 31 and 88. The so that the spec can be used by other standards to demonstrate compliance with these Articles. I am talking with Jan and Harsh about this, this week, and intend to virtualy attend the meeting for this at the end of the month. Ideally, we can approve a) the contribution and collaboration with DGSI , b) the ANCR comment submitted to Canadian Mirror Committee, and subsequently ISO for the next meeting, (aka by the end of the next week. Can you add these to the agenda? I will aim to get drafts over to the work group, asap. Best, Mark On 6 Sep 2024, at 09:31, Salvatore D'Agostino <sal@idmachines.com <mailto:sal@idmachines.com> > wrote: Dear Mark, The opportunity with DGSI, the upcoming ISO meeting, and the need to complete the publications on our roadmap, requires us to focus on these projects/publications to take advantage of this. The direction below does not change the work or the direction of what we have underway. In all cases we need to finalize the scope and get out the TPI/TPS, and CRv2. I suggest that we use the majority of the meeting to assess where we are at, and what we commit to accomplishing. Sincerely, Sal From: Mark Lizar <mark@transparencylab.ca <mailto:mark@transparencylab.ca> > Sent: Thursday, September 5, 2024 11:45 PM To: wg-ancr@kantarainitiative.org <mailto:wg-ancr@kantarainitiative.org> Subject: [WG-ANCR] Re: Next Steps - Notice and Consent Receipt v2, Dear WG, There has been some good forward movement on resolving long outstanding issues in advancing the work from the ANCR WG. Below I explain why I would like to propose that we take our v2 notice and consent receipt work to Data Governance Standards Institute (DGSI), a Canadian national standards body, as soon as possible. For those of you who donât know, there are some known challenges to progress the notice and consent receipt work. In summary: * Originally called the MVCR [Minimum Viable Consent Receipt], it was taken too soon to ISO and named 27560 Consent record information structure, without the CISWGâs knowledge * At ISO, it was politicised and diluted by numerous national inputs until it was unable to address the core issues of notice and consent * Consent requires open and standard transparency; its strength, integrity and viability depend on it. This is why the MVCR is a notice receipt, that anyone can use to consent with, Consent is essentially based on a notice record information structure, which is what ISO/IEC 29184 is focused on, as well as some very specific laws,. able to be used autonomously to demonstrate consent * It was specified to the ISO/IEC 29100 security and privacy framework which was open, but its l atest update is not * It was specified for ISO/IEC 291284 Online Privacy notice and consent standard, (see Appendix D 29184). This standard is not open (exclusive), so not operational as a international transparency and identity governance standard * Finally, 27560 the consent record information structure makes a fundamental error by confusing consent (managed by humans) with permission (managed by services) * Whats more, continuing this work via Kantara has a dis-advantage, As Kantara is not a national standard body, making a Special Interest Group, for Authc with members from national stakeholder a non viable path. For these reasons and more, the ANCR WG has always been viewed as a place to incubate standards for industry and regulatory use. This is why we have worked on a companion TP-Scheme that uses this specification to demonstrate conformance and compliance. The idea being that we, the ANCR WG, work on the scheme, and support its use and extension for a Kantara programme, or one that Kantara collaborates with. The ANCR WG demo, in collaboration with a specification at DGS is what is ultimately being proposed here as the immediate path forward DGSI are now recognised, accredited to make national and international standards, and have a direct route to ISO/IEC. Even more importantly, DGSI have an arrangement with ISO because their standards are open, the standards put forward to ISO will also be free and open to access. This provides us with a clear path for our v2 Notice and Consent specification to ISO, with national regulatory input, at no cost. To this end, the next plenary for ISO is coming up at the end of this month and comment is needed next week (w/c 9 September). I suggest we put forward to the 27560 that we have a proposed v2 to be developed in collaboration with DGSI, and that we have a TPS at Kantara, to assess validity of consent, Suggesting We move the TP-Scheme forward in this context - and from this context work on the AuthC SiG. Please comment and respond before next weeks meeting (Wed 12th of September) - Mark _______________________________________________ A Community Group mailing list of <http://kantarainitiative.org/> KantaraInitiative.org Wg-ancr mailing list -- <mailto:wg-ancr@kantarainitiative.org> wg-ancr@kantarainitiative.org To unsubscribe send an email to <mailto:staff@kantarainitiative.org> staff@kantarainitiative.org List archives -- <https://mailman.kantarainitiative.org/hyperkitty/list/wg-ancr@kantarainitiative.org/> https://mailman.kantarainitiative.org/hyperkitty/list/wg-ancr@kantarainitiat... ______ Group wiki -- <https://kantara.atlassian.net/wiki/spaces/Wg-ancr> https://kantara.atlassian.net/wiki/spaces/Wg-ancr ------=_NextPart_000_001F_01DB0049.494AE7E0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta = http-equiv=3DContent-Type content=3D"text/html; charset=3Dutf-8"><meta = name=3DGenerator content=3D"Microsoft Word 15 (filtered = medium)"><style><!-- /* Font Definitions */ @font-face {font-family:Helvetica; panose-1:2 11 6 4 2 2 2 2 2 4;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:"Yu Gothic"; panose-1:2 11 4 0 0 0 0 0 0 0;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Aptos;} @font-face {font-family:"\@Yu Gothic"; panose-1:2 11 4 0 0 0 0 0 0 0;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; font-size:12.0pt; font-family:"Aptos",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} span.apple-converted-space {mso-style-name:apple-converted-space;} span.EmailStyle21 {mso-style-type:personal-reply; font-family:"Aptos",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt; mso-ligatures:none;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} /* List Definitions */ @list l0 {mso-list-id:608463848; mso-list-template-ids:-932029938;} @list l0:level1 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level2 {mso-level-number-format:bullet; mso-level-text:o; mso-level-tab-stop:1.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:"Courier New"; mso-bidi-font-family:"Times New Roman";} @list l0:level3 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:1.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level4 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:2.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level5 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:2.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level6 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:3.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level7 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:3.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level8 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:4.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level9 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:4.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l1 {mso-list-id:1159730770; mso-list-template-ids:349612658;} @list l1:level1 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l1:level2 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:1.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l1:level3 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:1.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l1:level4 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:2.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l1:level5 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:2.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l1:level6 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:3.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l1:level7 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:3.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l1:level8 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:4.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l1:level9 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:4.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l2 {mso-list-id:1483963873; mso-list-template-ids:-583513582;} @list l2:level1 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l2:level2 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:1.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l2:level3 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:1.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l2:level4 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:2.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l2:level5 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:2.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l2:level6 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:3.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l2:level7 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:3.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l2:level8 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:4.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l2:level9 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:4.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} ol {margin-bottom:0in;} ul {margin-bottom:0in;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue = vlink=3Dpurple style=3D'word-wrap:break-word'><div = class=3DWordSection1><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Yes, I can start a draft agenda and include = this.<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'><o:p> </o:p></span></p><div><div = style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in = 0in 0in'><p class=3DMsoNormal><b><span = style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span><= /b><span style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'> = Mark Lizar <mark@transparencylab.ca> <br><b>Sent:</b> Friday, = September 6, 2024 10:23 AM<br><b>To:</b> Salvatore D'Agostino = <sal@idmachines.com><br><b>Cc:</b> = wg-ancr@kantarainitiative.org<br><b>Subject:</b> Re: [WG-ANCR] Next = Steps - Notice and Consent Receipt = v2,<o:p></o:p></span></p></div></div><p = class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal>Hi Sal, = (ANCR WG) <o:p></o:p></p><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal>Thanks for tea=E2=80=99ing this up. The = challenges to completing work, which we have discussed at length through = submissions of proposals for funding, are addressed if we collaborate = with DGSI, move the CR V2 work there, and then update the = TP-Scheme. <o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal> 27560, which is now chaired by Jan and Harsh, = has a new number 27569, to add the other legal justifications to the = 27560 standard. The aim is to submit a comment from ANCR, to ISO = as well as via the Canadian SC27 Mirror Committee, that KI ANCR WG, is = collaborating with DGSI, to submit a draft update to 27560, for = 27569. <o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal>Perhaps we can add something towards, addressing = roles, distinguishing permission from consent, not identifying the = individual be default, but making this the choice of the PII principal, = with personal data control. Specified specifically to Conv = 108+ - (which is mirrored by GDPR) to address Article - 13-17, 31 and = 88. <o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal>The so that the spec can be used by other standards to = demonstrate compliance with these Articles. I am talking with Jan = and Harsh about this, this week, and intend to virtualy attend the = meeting for this at the end of the = month. <o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal>Ideally, we can = approve <o:p></o:p></p></div><div><p class=3DMsoNormal>a) the = contribution and collaboration with DGSI = , <o:p></o:p></p></div><div><p class=3DMsoNormal>b) the ANCR = comment submitted to Canadian Mirror Committee, and subsequently ISO for = the next meeting, (aka by the end of the next = week. <o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal>Can you add these to the agenda? I will aim to = get drafts over to the work group, = asap. <o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal>Best, <o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal>Mark <o:p></o:p></p></div><div><p = class=3DMsoNormal> <o:p></o:p></p></div><div><div><p = class=3DMsoNormal><br><br><o:p></o:p></p><blockquote = style=3D'margin-top:5.0pt;margin-bottom:5.0pt'><div><p = class=3DMsoNormal>On 6 Sep 2024, at 09:31, Salvatore D'Agostino <<a = href=3D"mailto:sal@idmachines.com">sal@idmachines.com</a>> = wrote:<o:p></o:p></p></div><p = class=3DMsoNormal><o:p> </o:p></p><div><div><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>Dear = Mark,</span><o:p></o:p></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'> </span><o:p></o:p></p></div><div><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>The opportunity with = DGSI, the upcoming ISO meeting, and the need to complete the = publications on our roadmap, requires us to focus on these = projects/publications to take advantage of = this.</span><o:p></o:p></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'> </span><o:p></o:p></p></div><div><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>The direction below = does not change the work or the direction of what we have underway. In = all cases we need to finalize the scope and get out the TPI/TPS, and = CRv2.</span><o:p></o:p></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'> </span><o:p></o:p></p></div><div><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>I suggest that we use = the majority of the meeting to assess where we are at, and what we = commit to accomplishing.</span><o:p></o:p></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:11.0pt'> </span><o:p></o:p></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Sincerely,</span><o:p></o:p></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Sal</span><o:p></o:p></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:11.0pt'> </span><o:p></o:p></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:11.0pt'> </span><o:p></o:p></p></div><div><div = style=3D'border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0in = 0in 0in;border-color:currentcolor currentcolor;border-image: = none'><div><p class=3DMsoNormal><b><span = style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span><= /b><span class=3Dapple-converted-space><span = style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'> </span>= </span><span = style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Mark Lizar = <<a = href=3D"mailto:mark@transparencylab.ca">mark@transparencylab.ca</a>><b= r><b>Sent:</b><span class=3Dapple-converted-space> </span>Thursday, = September 5, 2024 11:45 PM<br><b>To:</b><span = class=3Dapple-converted-space> </span><a = href=3D"mailto:wg-ancr@kantarainitiative.org">wg-ancr@kantarainitiative.o= rg</a><br><b>Subject:</b><span = class=3Dapple-converted-space> </span>[WG-ANCR] Re: Next Steps - = Notice and Consent Receipt = v2,</span><o:p></o:p></p></div></div></div><div><p = class=3DMsoNormal> <o:p></o:p></p></div><div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black;back= ground:white'>Dear = WG, </span><o:p></o:p></p></div></div><div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black;back= ground:white'><br><br><br></span><o:p></o:p></p></div></div><div><div = style=3D'margin-bottom:8.0pt'><p = style=3D'margin-bottom:8.0pt;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>The= re has been some good forward movement on resolving long outstanding = issues in advancing the work from the ANCR WG. Below I explain why I = would like to propose that we take our v2 notice and consent receipt = work to Data Governance Standards Institute (DGSI), a Canadian national = standards body, as soon as possible. </span><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><o:p></o:p><= /span></p><p style=3D'margin-bottom:8.0pt;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>For= those of you who don=E2=80=99t know, there are some known challenges to = progress the notice and consent receipt work. In = summary: </span><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><o:p></o:p><= /span></p><ul style=3D'margin-top:0in' type=3Ddisc><li class=3DMsoNormal = style=3D'mso-list:l2 level1 lfo1;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>Ori= ginally called the MVCR [Minimum Viable Consent Receipt], it was taken = too soon to ISO and named 27560 Consent record information structure, = without the CISWG=E2=80=99s knowledge </span><o:p></o:p></li><li = class=3DMsoNormal style=3D'mso-list:l2 level1 = lfo1;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>At = ISO, it was politicised and diluted by numerous national inputs until it = was unable to address the core issues of notice and = consent </span><o:p></o:p></li><li class=3DMsoNormal = style=3D'mso-list:l2 level1 lfo1;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>Con= sent requires open and standard transparency; its strength, integrity = and viability depend on it. This is why the MVCR is a notice receipt, = that anyone can use to consent with, Consent is essentially based on a = notice record information structure, which is what ISO/IEC 29184 is = focused on, as well as some very specific laws,. able to be used = autonomously to demonstrate consent </span><o:p></o:p></li></ul><ul = style=3D'margin-top:0in' type=3Ddisc><ul style=3D'margin-top:0in' = type=3Dcircle><li class=3DMsoNormal style=3D'mso-list:l0 level2 = lfo2;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>It = was specified to the ISO/IEC 29100 security and privacy framework which = was open, but its latest update is not </span><o:p></o:p></li><li = class=3DMsoNormal style=3D'mso-list:l0 level2 = lfo2;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>It = was specified for ISO/IEC 291284 Online Privacy notice and consent = standard, (see Appendix D 29184). This standard is not open (exclusive), = so not operational as a international transparency and identity = governance standard </span><o:p></o:p></li></ul></ul><ul = style=3D'margin-top:0in' type=3Ddisc><li class=3DMsoNormal = style=3D'mso-list:l1 level1 lfo3;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>Fin= ally, 27560 the consent record information structure makes a fundamental = error by confusing consent (managed by humans) with permission (managed = by services) </span><o:p></o:p></li><li class=3DMsoNormal = style=3D'mso-list:l1 level1 lfo3;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>Wha= ts more, continuing this work via Kantara has a dis-advantage, As = Kantara is not a national standard body, making a Special Interest = Group, for Authc with members from national stakeholder a non viable = path. </span><o:p></o:p></li></ul><p = style=3D'margin-bottom:8.0pt;background:white'><span = style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>&= nbsp;</span><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><o:p></o:p><= /span></p><p style=3D'margin-bottom:8.0pt;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>For= these reasons and more, the ANCR WG has always been viewed = as a place to incubate standards for industry and regulatory use. This = is why we have worked on a companion TP-Scheme that uses this = specification to demonstrate conformance and compliance. The idea being = that we, the ANCR WG, work on the scheme, and support its use and = extension for a Kantara programme, or one that Kantara collaborates = with. </span><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><o:p></o:p><= /span></p><p style=3D'margin-bottom:8.0pt;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>The= ANCR WG demo, in collaboration with a specification at DGS = is what is ultimately being proposed here as the immediate path = forward </span><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><o:p></o:p><= /span></p><p style=3D'margin-bottom:8.0pt;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>DGS= I are now recognised, accredited to make national and international = standards, and have a direct route to ISO/IEC. Even more importantly, = DGSI have an arrangement with ISO because their standards are open, the = standards put forward to ISO will also be free and open to access. = This provides us with a clear path for our v2 Notice and Consent = specification to ISO, with national regulatory input, at no = cost. </span><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><o:p></o:p><= /span></p><p style=3D'margin-bottom:8.0pt;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>To = this end, the next plenary for ISO is coming up at the end of this month = and comment is needed next week (w/c 9 September).</span><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><o:p></o:p><= /span></p><p style=3D'margin-bottom:8.0pt;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>I = suggest we put forward to the 27560 that we have a proposed v2 to be = developed in collaboration with DGSI, and that we have a TPS at = Kantara, to assess validity of consent, </span><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><o:p></o:p><= /span></p><p style=3D'margin-bottom:8.0pt;background:white'><span = style=3D'font-size:10.5pt;font-family:"Arial",sans-serif;color:black'>Sug= gesting We move the TP-Scheme forward in this context - and from this = context work on the AuthC SiG. </span><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><o:p></o:p><= /span></p><p style=3D'margin-bottom:8.0pt;background:white'><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black'>= Please comment and respond before next weeks meeting (Wed 12th of = September) </span><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><o:p></o:p><= /span></p><p style=3D'margin-bottom:8.0pt;background:white'><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black'>= </span><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><o:p></o:p><= /span></p><p style=3D'margin-bottom:8.0pt;background:white'><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black'>= - Mark </span><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><o:p></o:p><= /span></p><div><p = class=3DMsoNormal> <o:p></o:p></p></div></div></div><div><div><p = class=3DMsoNormal> <o:p></o:p></p></div></div><p = class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>____________= ___________________________________<br>A Community Group mailing list = of<span class=3Dapple-converted-space> </span></span><a = href=3D"http://kantarainitiative.org/"><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>KantaraIniti= ative.org</span></a><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><br>Wg-ancr = mailing list --<span = class=3Dapple-converted-space> </span></span><a = href=3D"mailto:wg-ancr@kantarainitiative.org"><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>wg-ancr@kant= arainitiative.org</span></a><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><br>To = unsubscribe send an email to<span = class=3Dapple-converted-space> </span></span><a = href=3D"mailto:staff@kantarainitiative.org"><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>staff@kantar= ainitiative.org</span></a><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><br>List = archives -- </span><a = href=3D"https://mailman.kantarainitiative.org/hyperkitty/list/wg-ancr@kan= tarainitiative.org/"><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>https://mail= man.kantarainitiative.org/hyperkitty/list/wg-ancr@kantarainitiative.org/<= /span></a><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'><br>______<b= r>Group wiki --<span = class=3Dapple-converted-space> </span></span><a = href=3D"https://kantara.atlassian.net/wiki/spaces/Wg-ancr"><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>https://kant= ara.atlassian.net/wiki/spaces/Wg-ancr</span></a><o:p></o:p></p></div></bl= ockquote></div><p = class=3DMsoNormal><o:p> </o:p></p></div></div></body></html> ------=_NextPart_000_001F_01DB0049.494AE7E0-- ü0`0H BE#ÈDµ0 *H÷ 0J1 0 UUS10U IdenTrust1'0%U IdenTrust Commercial Root CA 10 140116181223Z 340116181223Z0J1 0 UUS10U IdenTrust1'0%U IdenTrust Commercial Root CA 10"0 *H÷ 0 §PÞ?=Ô3FñoQa²©Og]ÙSÝ (Ù×ðÿ®Crùµ]|ÁBá1PtÑ |Í!«Câ¬^nó Z2œ¢ëùè\ ìÿÒ¯q³ŽSNìO20K^WÄSÂöÙb+¿$ bßÞ)KIx<`"üÚ6È¢Ô,Tg5ns¿Xð€Ýå°¢&zÊà6¥õý·ï®?@õmZýÎ4Ê$Üt#]3]Ä%ö0Ý]àÕGœŽë¡»IIØ[óä$äbOOÁ¯tšÑrjzIÌŽFyÆ±Ú Yúu! eÝVÎû«¥`ÄùR°œù+# #v;÷3áÉóiùK¢àNŒ~9÷Dp~þZ屬ÑÌò5åIIÊVÉ=û};ÁÂMÉO7é ¡jßb.Ë5Qy,È%8ôúK§\Òã 9Jt|ÕYÂ?N \Rô=÷Rñ꣬ýI4(óA:îèÞÿ _ºËè ò¹P`À1ÓsåïŸ í3 tŸ ÄglðzUFN§ô >áöØ á3d+c×2^ùÀ{xoŒùxz×rtUtx±ºánpºO ºhÃ{ÿ1ðs==*± A þMeky3Ž×£B0@0U ÿ0U ÿ0ÿ0 U íDÀÓðî€{ŸBç&TÈ6v0 *H÷ ®2öŠK|Dva '(Í^Tï%Œãù)×®háXï..~SR¶\êºP×ßa æÎÁò7x°_³¢sž8Í>°žûÀϱòì--Ì쪳ª`-;Ã=W užÓ0Í`ÓTñMfÀ]t@£î ~ wèÁ§]RíÉÝ%mú©í£:4ÐY{ÚíPó5¿íëM1Ç`ôÚñâHâÆÅ7ûúuYf1G)Úv é®ï¹Q÷#ib<åU6×Tÿñ¹]ÎÔ#oØEJ[eï ݧ Ë¥%Ž ùð¢ÒôÈt¡*HeÛÄâ%}ëŸ[ TQJS ì]Ê3íbýEÇ/[ÜX 9æú×þŠí=JBtÔÃwYsÍFŸU8ïúè2êX"Þ8ÃÌŒmÉ3:j i? Èêrc#œm<àILª¢¹*6xíÃèFâ&YDu ÙuQÍa`Ë]ù"Mæãö[»®ÍÊJk^ óQát+é~'§ÙINø¥Û% cbÉ3gk<ÆÞšÍð7qò«üAõÁì7] åNïú±\8¥JáÜ8-<Ü« ÕJîÑplÌîôWøºn00 @žáê<zÌ>BO0 *H÷ 0:1 0 UUS10U IdenTrust10UTrustID CA A140 240425192606Z 260426192506Z0M1!0 *H÷ sal@idmachines.com1(0&U A01410C0000018F16B8E1DC00130CBB0"0 *H÷ 0 êPV_FŒÞÇYÞ»1w@ ÿÈÈr/n䜻uoBŠZ@^üÈ »wýVá!ó}gk°
:¥4:ütÅe"°³Xɺ&XºðpÓ²>ºEÍ? z ¬b^ 5á¯ôRiÓïVOgLaèÕ².úrÑF~ÃöÕ?ô5,ËÅú2¯á âœú"EÆšŽ5õ4Åk~C P*ÒfnTnhÄÈ*£}ÞIºÝ€VÛÄ TÞÄEh\8ºº ù]BÊÑÈQ i1¢/vNþŠÆk'5²;6ÿËènë®0 |=£0 0 U ÿ00U ÿ 0+x0v00+0$http://commercial.ocsp.identrust.com0B+06http://validation.identrust.com/certs/trustidcaa14.p7c0 U #0ÂÔD qÏHVŸ h8\§·÷EŒ0#U 00 g 0 `Hù/ 0EU >0<0: 8 64http://validation.identrust.com/crl/trustidcaa14.crl0 U 0sal@idmachines.com0 U 6(Óqï/ØD@Ø;lmXæSE~0U % 0 +0 *H÷ °`ó0Äùê2`'3V-ŠÔý.ÛvéñNF$~L /2A2õþèC(á£Ãüûdï\×î ;!)GùÓ¬NÍÏÐÖ®êòrš¥ %]TaË#ÑQ÷ ²Ö/ªÆÛä$]IÙNØCÓ*Yµ°ôHàî+Ȋ壪aóòœyJl[RU *wœZº é%¹v9N6¬N}íà³so4=µ#Ü)}MÅQWãQüÊoHÖþÿ©ðMoÊÌ^ªê,®j³± Li;I)¡Øâ&È:÷€ô ÿÕç<fëñA±°ßÙm°x~š -Çu<Îý>>U±5 íkªmÀÇÏë|Ô`îMEa³©)&sGriûi=Ñïfhµîuø$Ðqà 6ÅÆ< A<šÄÞAr7À¢ dŒÀ£0ŠbZÍ»ÄÏž.î£ú§ Bì)! Ûª¬Éã#jÕäbßúätâV \1èÑÄN ÓÝÝ ^ÐGÜ]šb¹Ü ÞFûn}Ácô2ŽÅ]OÝ 1ö)ÉË ."La \ W!!ìRj[Ø@ðÒ{ìKÆ+ÜZ3Ù%¯Áf{ " ÀË7WF¯\¬1vyÓŽÄ0ô0Ü @ÿÒi ÚwÂéÕMM0 *H÷ 0J1 0 UUS10U IdenTrust1'0%U IdenTrust Commercial Root CA 10 230816192846Z 330812192845Z0:1 0 UUS10U IdenTrust10UTrustID CA A140"0 *H÷ 0 è©õŒ±éäÙËíX€ËF`eð¬ûÃA`kX»0DÙ9bÜrÁ ñRñÕ׫²3È÷6u/!²Öa§? Œ§8lxn×î%ûf¬<²Ñ»X$=-Ÿà§ÆÍ£EðiùëžÅFÖ{ePH»òÒßqEK tG%£¹yP2`A6ìL[Nä\ÍÒ§»Ó À[:«CQR ãL|70ídj¢Et«¹}Ì u÷@ òxb× Æ°K=°1dªØØWÐ.ïvkª r Xý(bšFr|qG Ôñ³ÿ£|\3òÚ tÈ:ÒXTߌô Bp`¡Â`@±[xoÄR^.W°ö@ÁÃé7¯Ì;Œ=Us¯Ø$YÂîn íºË*tÅùÛò\ oþåê'Y. xp,¬ \¿åù!³I.EÛË7ßÔh[P:4£ÿ]|×2`vZXtZ+cÒŒ~ÚÖP!!4Ó3aózG]wËí=.DÜ"X¯jë]êq?å§â!»aææVBJFQCj)(ñ" êÀÈ"©&?žR§gßû--Ùùt=µK7w¬eÀ#×k%ã3Ö)ŠÁåwsšxh:ÂÝ 8Ÿmí& Û5®i"\OŽEÝ£ä0à0U ÿ0ÿ0U ÿ0+}0{00+0$http://commercial.ocsp.identrust.com0G+0;http://validation.identrust.com/roots/commercialrootca1.p7c0 U #0íDÀÓðî€{ŸBç&TÈ6v0_U X0V0TU 0L0J+>https://secure.identrust.com/certificates/policy/ts/index.html0JU C0A0? = ;9http://validation.identrust.com/crl/commercialrootca1.crl0 U ÂÔD qÏHVŸ h8\§·÷EŒ0AU %:08++ +7 +7 +7 0 *H÷ ò][i]ãR®hÝE#+ 9q7%,Lya`VRÐÛ|ìAs«ÊœkYPÄÜ dw S_ÇS¡Šá°èö(1Ü@ žæŒ&tš-B9̧åÚTt³Ý¿xQ ¿0_¬óã°lÏ>Çc@±]NDì[£]ùb9"fkj¬Ø ç ÀɬŻµû]5O®šªJ}ø@/Sä" :MÄ ¥ÜIpÎ-'- WÌ»/MNΟaŒ@,µtí ¿ÛøÎxÒ]ªK'Eh2»ëô¬EØÍìÁjìñK³Ô g£JGÌüž«b]aÕ6ì·»m>Ë¡Ér"HA)ãÔ®r"Dë$\4Áìwš"0ØëQ%DœÐgëZÏ]\×¹IŽ¶l#@0â èÜ; £_àº,÷íèjA=UéOÆ0üôÈÖAg!Y6 ô*s! YT ÉŒ¿é©J^íxàÝN}ý+Š°L%Rmü?â /[ìs$ßÃÿeZ((ôjdÓ±x*EB;2SšDåêìÄXyÈÍÏ3ké/ ÒysáÎZªf²žÍ~º£±}EÐ*)K]b8NU¢f1<080N0:1 0 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0 `He ¿0 *H÷ 1 *H÷ 0 *H÷ 1 240906144109Z0/ *H÷ 1" žÕÅ1È¿*!°Å>Y »ÀºœA D*¥zÎ0] +71P0N0:1 0 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0_ *H÷ 1P N0:1 0 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0 *H÷ 1 00 `He*0 `He0 *H÷ 0 `He0*H÷ 0 *H÷ @0 `He0 `He0 `He0+0 *H÷ $¿ËÔÕ~NQý1œë!ÞKTe,®'ûZa\c#»}hA}k ÊÞÍQÓo¡º€±Aoÿ-ö"`ÄÇóN ÷²eúnBÁDê Ô ;2é@t?"ï¿ßSþ¯ÞNdóI±[+ lñH8D±ç¥ÊÓÕYPe!lÜB»Í ùk4šÖÔe;\çaÖ«)W`Û %Nç /àôÊA|*`Ê!uT!tG i &0ÒT¹Ã\J#ÖÈÍS~å îzCÿ L" k ¯ ˱_¢òà¬è¥1Û9Ìþne[Ö€è(ì[ÀÎá
So - what I'm getting from this thread is that after you made a request for funding support from Kantara (which was on a good track to be approved), you are going to take the work to yet another organization. And in doing so, because you don't listen to advice about how the various systems work, you are going to end up in a dead end. Kantara has indulged you for many years with not much to show for it beyond the work that others did on your behalf to make the work surface at ISO SC27 - which you then shit on repeatedly. Your welcome is wearing out Mark. ———————— *Andrew Hughes *CISM m +1 250.888.9474 AndrewHughes3000@gmail.com On Fri, Sep 6, 2024 at 7:41 AM Salvatore D'Agostino <sal@idmachines.com> wrote:
_______________________________________________ A Community Group mailing list of KantaraInitiative.org Wg-ancr mailing list -- wg-ancr@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-ancr@kantarainitiat... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/Wg-ancr
HI Andrew, I regret that my note about furthering the ANCR work led to such a reaction from you. My intention was not to provoke, but to deliver on a constructive path forward. As you know, there are issues around ISO being open; As well as how it was forked from the CISWG. This proposal enables us to collaborate with an organisation and to produce a spec and demo with national support and resources. Thank you for bringing these matters up as it provides me with a chance to clarify the situation. The Consent Receipt work was taken to ISO without the WG’s knowledge, where it was incorrectly named, the CISWG wiki was shut down, and progress on this work was delayed significantly. In my view, these actions were not taken on my behalf but at my expense and the expense of the people who contributed to the work. Which was not you. That being said international standardisation personal data control and the governance of digital identity it is a complex issue. Working on an open transparency standard that can be internationally usable for consent based data exchange and security has been tough, As you are not a member of this work group, you are likely not be aware of the 4 proposals over the last 5 years to further this international standard with national regulators. In fact, we were funded by EU NGI Trust for transparency signalling to operationalise consent, As a result, in our roadmap we have planned ito work on the transparency scheme in ANCR and the companion standard at DGSI, which will ensure the standard is open at ISO, and enable national and international collaborations which are not possible from the ANCR WG. In this collaboration we have great expectations as a developing benefit for Kantara with ANCR as the convenor of this collaboration, And we are looking for Kantara to support and participate. Which is likely what is threatening your enough to be so un-proffessional. To address etiquette issues, we have worked on a consensus policy protocol, to ensure consensus and ettiquette and also to play an ongoing role, suited to the ANCR WG, in the development of this policy The key here is the Transparency Performance Scheme, which ANCR can and will use to support digital trust assurance program in the future. A tremendous opportunity for Kantara,. The KI Demo of ANCR, an inclusive, equitable, and governed digital identity alternative will be amazing step forward, a step I hope you reconsider your support, and conduct yourself more appropiorately on this mailing list going forward, Best Regards, Mark On 6 Sep 2024, at 13:23, Andrew Hughes <andrewhughes3000@gmail.com> wrote: So - what I'm getting from this thread is that after you made a request for funding support from Kantara (which was on a good track to be approved), you are going to take the work to yet another organization. And in doing so, because you don't listen to advice about how the various systems work, you are going to end up in a dead end. Kantara has indulged you for many years with not much to show for it beyond the work that others did on your behalf to make the work surface at ISO SC27 - which you then shit on repeatedly. Your welcome is wearing out Mark. ———————— Andrew Hughes CISM m +1 250.888.9474 AndrewHughes3000@gmail.com<mailto:AndrewHughes3000@gmail.com> On Fri, Sep 6, 2024 at 7:41 AM Salvatore D'Agostino <sal@idmachines.com<mailto:sal@idmachines.com>> wrote: _______________________________________________ A Community Group mailing list of KantaraInitiative.org Wg-ancr mailing list -- wg-ancr@kantarainitiative.org<mailto:wg-ancr@kantarainitiative.org> To unsubscribe send an email to staff@kantarainitiative.org<mailto:staff@kantarainitiative.org> List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-ancr@kantarainitiat... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/Wg-ancr
Mark - you should not be surprised - every 3-4 years you announce that you are going to take the work into some other organization - and every time I inform you that it's not the right way to make progress - my stridency has increased over the years as my frustration mounts. That's a very interesting revisionist history you present. You might want to look closer at how DGSI's path to ISO publication actually functions - on the surface it is as you say - but it doesn't actually result in what you claim. The original CR v1.1 was contributed to SC 27/WG 5 with the approval of the CISWG - of which you were a member at the time. The work followed a normal path inside the ISO WG (which is national and international collaboration to arrive at a consensus result). And as you pointed out, two of the lead participants in the CR work are now extending the ISO work. "Free to download" does not mean "open". All of the other organizations that you have tried to get into have rules and funding mechanisms and revenue models. Just wait until the bill is presented to you at DGSI - it is no different than any other member-based organization. It's probably time for this work to stop at Kantara entirely - since clearly the grass is greener elsewhere. I'll let others decide that. Don't misunderstand me - the receipt work IS important and valuable - that is precisely why we advanced it into ISO SC 27 and got such strong international participation there. And the work continues there. ———————— *Andrew Hughes *CISM m +1 250.888.9474 AndrewHughes3000@gmail.com On Fri, Sep 6, 2024 at 11:38 AM Mark Lizar <mark@transparencylab.ca> wrote:
HI Andrew,
I regret that my note about furthering the ANCR work led to such a reaction from you. My intention was not to provoke, but to deliver on a constructive path forward. As you know, there are issues around ISO being open; As well as how it was forked from the CISWG. This proposal enables us to collaborate with an organisation and to produce a spec and demo with national support and resources. Thank you for bringing these matters up as it provides me with a chance to clarify the situation.
The Consent Receipt work was taken to ISO without the WG’s knowledge, where it was incorrectly named, the CISWG wiki was shut down, and progress on this work was delayed significantly. In my view, these actions were not taken on my behalf but at my expense and the expense of the people who contributed to the work. Which was not you.
That being said international standardisation personal data control and the governance of digital identity it is a complex issue. Working on an open transparency standard that can be internationally usable for consent based data exchange and security has been tough,
As you are not a member of this work group, you are likely not be aware of the 4 proposals over the last 5 years to further this international standard with national regulators. In fact, we were funded by EU NGI Trust for transparency signalling to operationalise consent,
As a result, in our roadmap we have planned ito work on the transparency scheme in ANCR and the companion standard at DGSI, which will ensure the standard is open at ISO, and enable national and international collaborations which are not possible from the ANCR WG.
In this collaboration we have great expectations as a developing benefit for Kantara with ANCR as the convenor of this collaboration, And we are looking for Kantara to support and participate. Which is likely what is threatening your enough to be so un-proffessional.
To address etiquette issues, we have worked on a consensus policy protocol, to ensure consensus and ettiquette and also to play an ongoing role, suited to the ANCR WG, in the development of this policy
The key here is the Transparency Performance Scheme, which ANCR can and will use to support digital trust assurance program in the future. A tremendous opportunity for Kantara,.
The KI Demo of ANCR, an inclusive, equitable, and governed digital identity alternative will be amazing step forward, a step I hope you reconsider your support, and conduct yourself more appropiorately on this mailing list going forward,
Best Regards,
Mark
On 6 Sep 2024, at 13:23, Andrew Hughes <andrewhughes3000@gmail.com> wrote:
So - what I'm getting from this thread is that after you made a request for funding support from Kantara (which was on a good track to be approved), you are going to take the work to yet another organization. And in doing so, because you don't listen to advice about how the various systems work, you are going to end up in a dead end. Kantara has indulged you for many years with not much to show for it beyond the work that others did on your behalf to make the work surface at ISO SC27 - which you then shit on repeatedly. Your welcome is wearing out Mark. ———————— *Andrew Hughes *CISM m +1 250.888.9474 AndrewHughes3000@gmail.com
On Fri, Sep 6, 2024 at 7:41 AM Salvatore D'Agostino <sal@idmachines.com> wrote:
_______________________________________________ A Community Group mailing list of KantaraInitiative.org Wg-ancr mailing list -- wg-ancr@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-ancr@kantarainitiat... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/Wg-ancr
Hi Andrew, Despite my recommendation you want to continue to discuss this in this forum, which is disappointing. For now, it seems we must agree to disagree, but my door's always open, if you want to contribute in a constructive way. If not, please stop trolling this list. FWIW, I have shared your concerns below with Keith Jensa the CEO and DarrylKingston, the Executive director, and they assure me that there is no cost to the standard and would be happy to sit down with you, and leadership who is interested to discuss this further. Best, Mark On 6 Sep 2024, at 15:17, Andrew Hughes <andrewhughes3000@gmail.com> wrote: Mark - you should not be surprised - every 3-4 years you announce that you are going to take the work into some other organization - and every time I inform you that it's not the right way to make progress - my stridency has increased over the years as my frustration mounts. That's a very interesting revisionist history you present. You might want to look closer at how DGSI's path to ISO publication actually functions - on the surface it is as you say - but it doesn't actually result in what you claim. The original CR v1.1 was contributed to SC 27/WG 5 with the approval of the CISWG - of which you were a member at the time. The work followed a normal path inside the ISO WG (which is national and international collaboration to arrive at a consensus result). And as you pointed out, two of the lead participants in the CR work are now extending the ISO work. "Free to download" does not mean "open". All of the other organizations that you have tried to get into have rules and funding mechanisms and revenue models. Just wait until the bill is presented to you at DGSI - it is no different than any other member-based organization. It's probably time for this work to stop at Kantara entirely - since clearly the grass is greener elsewhere. I'll let others decide that. Don't misunderstand me - the receipt work IS important and valuable - that is precisely why we advanced it into ISO SC 27 and got such strong international participation there. And the work continues there. ———————— Andrew Hughes CISM m +1 250.888.9474 AndrewHughes3000@gmail.com<mailto:AndrewHughes3000@gmail.com> On Fri, Sep 6, 2024 at 11:38 AM Mark Lizar <mark@transparencylab.ca<mailto:mark@transparencylab.ca>> wrote: HI Andrew, I regret that my note about furthering the ANCR work led to such a reaction from you. My intention was not to provoke, but to deliver on a constructive path forward. As you know, there are issues around ISO being open; As well as how it was forked from the CISWG. This proposal enables us to collaborate with an organisation and to produce a spec and demo with national support and resources. Thank you for bringing these matters up as it provides me with a chance to clarify the situation. The Consent Receipt work was taken to ISO without the WG’s knowledge, where it was incorrectly named, the CISWG wiki was shut down, and progress on this work was delayed significantly. In my view, these actions were not taken on my behalf but at my expense and the expense of the people who contributed to the work. Which was not you. That being said international standardisation personal data control and the governance of digital identity it is a complex issue. Working on an open transparency standard that can be internationally usable for consent based data exchange and security has been tough, As you are not a member of this work group, you are likely not be aware of the 4 proposals over the last 5 years to further this international standard with national regulators. In fact, we were funded by EU NGI Trust for transparency signalling to operationalise consent, As a result, in our roadmap we have planned ito work on the transparency scheme in ANCR and the companion standard at DGSI, which will ensure the standard is open at ISO, and enable national and international collaborations which are not possible from the ANCR WG. In this collaboration we have great expectations as a developing benefit for Kantara with ANCR as the convenor of this collaboration, And we are looking for Kantara to support and participate. Which is likely what is threatening your enough to be so un-proffessional. To address etiquette issues, we have worked on a consensus policy protocol, to ensure consensus and ettiquette and also to play an ongoing role, suited to the ANCR WG, in the development of this policy The key here is the Transparency Performance Scheme, which ANCR can and will use to support digital trust assurance program in the future. A tremendous opportunity for Kantara,. The KI Demo of ANCR, an inclusive, equitable, and governed digital identity alternative will be amazing step forward, a step I hope you reconsider your support, and conduct yourself more appropiorately on this mailing list going forward, Best Regards, Mark On 6 Sep 2024, at 13:23, Andrew Hughes <andrewhughes3000@gmail.com<mailto:andrewhughes3000@gmail.com>> wrote: So - what I'm getting from this thread is that after you made a request for funding support from Kantara (which was on a good track to be approved), you are going to take the work to yet another organization. And in doing so, because you don't listen to advice about how the various systems work, you are going to end up in a dead end. Kantara has indulged you for many years with not much to show for it beyond the work that others did on your behalf to make the work surface at ISO SC27 - which you then shit on repeatedly. Your welcome is wearing out Mark. ———————— Andrew Hughes CISM m +1 250.888.9474 AndrewHughes3000@gmail.com<mailto:AndrewHughes3000@gmail.com> On Fri, Sep 6, 2024 at 7:41 AM Salvatore D'Agostino <sal@idmachines.com<mailto:sal@idmachines.com>> wrote: _______________________________________________ A Community Group mailing list of KantaraInitiative.org Wg-ancr mailing list -- wg-ancr@kantarainitiative.org<mailto:wg-ancr@kantarainitiative.org> To unsubscribe send an email to staff@kantarainitiative.org<mailto:staff@kantarainitiative.org> List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-ancr@kantarainitiat... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/Wg-ancr
On the Good News Side, Concordia is interested in a Digital Transparency Lab partnership, and with the IEEE community there offered to host the collaboration at Concordia university with DGSI. Promoting an industry, academic, and regulatory collaboration around standard transparency, In addition, York University, via Kate Tillizeck, who is the Canadian and research chair for children and youth, are also interested in participating to research the impact of using receipts and personal data control has on children and youth. This way we could turn the demo into a collaborative project with more funding resources. (Cc’ing Alec and Kay so they are Kantara Leadership are aware of the opportunity, more information will come next week after meeting with Concordia) Have a Great Weekend! Mark On 6 Sep 2024, at 10:22, Mark Lizar <mark@transparencylab.ca> wrote: Hi Sal, (ANCR WG) Thanks for tea’ing this up. The challenges to completing work, which we have discussed at length through submissions of proposals for funding, are addressed if we collaborate with DGSI, move the CR V2 work there, and then update the TP-Scheme. 27560, which is now chaired by Jan and Harsh, has a new number 27569, to add the other legal justifications to the 27560 standard. The aim is to submit a comment from ANCR, to ISO as well as via the Canadian SC27 Mirror Committee, that KI ANCR WG, is collaborating with DGSI, to submit a draft update to 27560, for 27569. Perhaps we can add something towards, addressing roles, distinguishing permission from consent, not identifying the individual be default, but making this the choice of the PII principal, with personal data control. Specified specifically to Conv 108+ - (which is mirrored by GDPR) to address Article - 13-17, 31 and 88. The so that the spec can be used by other standards to demonstrate compliance with these Articles. I am talking with Jan and Harsh about this, this week, and intend to virtualy attend the meeting for this at the end of the month. Ideally, we can approve a) the contribution and collaboration with DGSI , b) the ANCR comment submitted to Canadian Mirror Committee, and subsequently ISO for the next meeting, (aka by the end of the next week. Can you add these to the agenda? I will aim to get drafts over to the work group, asap. Best, Mark On 6 Sep 2024, at 09:31, Salvatore D'Agostino <sal@idmachines.com> wrote: Dear Mark, The opportunity with DGSI, the upcoming ISO meeting, and the need to complete the publications on our roadmap, requires us to focus on these projects/publications to take advantage of this. The direction below does not change the work or the direction of what we have underway. In all cases we need to finalize the scope and get out the TPI/TPS, and CRv2. I suggest that we use the majority of the meeting to assess where we are at, and what we commit to accomplishing. Sincerely, Sal From: Mark Lizar <mark@transparencylab.ca> Sent: Thursday, September 5, 2024 11:45 PM To: wg-ancr@kantarainitiative.org Subject: [WG-ANCR] Re: Next Steps - Notice and Consent Receipt v2, Dear WG, There has been some good forward movement on resolving long outstanding issues in advancing the work from the ANCR WG. Below I explain why I would like to propose that we take our v2 notice and consent receipt work to Data Governance Standards Institute (DGSI), a Canadian national standards body, as soon as possible. For those of you who don’t know, there are some known challenges to progress the notice and consent receipt work. In summary: * Originally called the MVCR [Minimum Viable Consent Receipt], it was taken too soon to ISO and named 27560 Consent record information structure, without the CISWG’s knowledge * At ISO, it was politicised and diluted by numerous national inputs until it was unable to address the core issues of notice and consent * Consent requires open and standard transparency; its strength, integrity and viability depend on it. This is why the MVCR is a notice receipt, that anyone can use to consent with, Consent is essentially based on a notice record information structure, which is what ISO/IEC 29184 is focused on, as well as some very specific laws,. able to be used autonomously to demonstrate consent * It was specified to the ISO/IEC 29100 security and privacy framework which was open, but its latest update is not * It was specified for ISO/IEC 291284 Online Privacy notice and consent standard, (see Appendix D 29184). This standard is not open (exclusive), so not operational as a international transparency and identity governance standard * Finally, 27560 the consent record information structure makes a fundamental error by confusing consent (managed by humans) with permission (managed by services) * Whats more, continuing this work via Kantara has a dis-advantage, As Kantara is not a national standard body, making a Special Interest Group, for Authc with members from national stakeholder a non viable path. For these reasons and more, the ANCR WG has always been viewed as a place to incubate standards for industry and regulatory use. This is why we have worked on a companion TP-Scheme that uses this specification to demonstrate conformance and compliance. The idea being that we, the ANCR WG, work on the scheme, and support its use and extension for a Kantara programme, or one that Kantara collaborates with. The ANCR WG demo, in collaboration with a specification at DGS is what is ultimately being proposed here as the immediate path forward DGSI are now recognised, accredited to make national and international standards, and have a direct route to ISO/IEC. Even more importantly, DGSI have an arrangement with ISO because their standards are open, the standards put forward to ISO will also be free and open to access. This provides us with a clear path for our v2 Notice and Consent specification to ISO, with national regulatory input, at no cost. To this end, the next plenary for ISO is coming up at the end of this month and comment is needed next week (w/c 9 September). I suggest we put forward to the 27560 that we have a proposed v2 to be developed in collaboration with DGSI, and that we have a TPS at Kantara, to assess validity of consent, Suggesting We move the TP-Scheme forward in this context - and from this context work on the AuthC SiG. Please comment and respond before next weeks meeting (Wed 12th of September) - Mark _______________________________________________ A Community Group mailing list of KantaraInitiative.org<http://kantarainitiative.org/> Wg-ancr mailing list -- wg-ancr@kantarainitiative.org<mailto:wg-ancr@kantarainitiative.org> To unsubscribe send an email to staff@kantarainitiative.org<mailto:staff@kantarainitiative.org> List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-ancr@kantarainitiat... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/Wg-ancr _______________________________________________ A Community Group mailing list of KantaraInitiative.org Wg-ancr mailing list -- wg-ancr@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-ancr@kantarainitiat... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/Wg-ancr
participants (3)
-
Andrew Hughes -
Mark Lizar -
Salvatore D'Agostino