- Wg-pemc - mailman.kantarainitiative.org

requirements
by Tom Jones 18 Jun '25

18 Jun '25

I think we need to be more prescriptive on requirements. I think we need minimum requirements. I would change Test Results - Meets Requirement: The Verifier meets all test conditions for its use case. - Partially Meets Requirement: The Verifier meets at least 50% of the test conditions for its use case.Does Not Meet Requirement: The Verifier meets less than 50% of the test conditions for its use case. to Test Results - Meets Requirement: The Verifier meets all test conditions for its use case. - Meets Minimum Requirement: The Verifier meets all of the minimal test conditions for all use cases that it is designed to handle.Does Not Meet Requirement: The Verifier meets less than 50% of the test conditions for its use case. Peace ..tom jones

2 1

The wallet demarcation problem: developing a taxonomy for classifying digital wallets
by John Wunderlich 18 Jun '25

18 Jun '25

FYI: https://proceedings.open.tudelft.nl/DGO2025/article/view/1039 Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Notice - Release of Work Group Participant Code of Conduct
by Amanda Gay 17 Jun '25

17 Jun '25

Dear WG Participants: This email is to inform you that the Work Group Participant Code of Conduct <https://kantara.atlassian.net/wiki/spaces/LC/pages/1055227915/Code+of+Condu…> has been passed by the Leadership Council and is in effect immediately – all group participation is now subject to the Code of Conduct. Reminder: Participation in Kantara Work Groups is subject to all Kantara policies <https://kantara.atlassian.net/wiki/spaces/GI/pages/1081775/All+Policies>. The Code of Conduct is now explicitly included in the Group Participation Agreement (GPA) for transparency as part of the applicable policies for Work Group participation. We request that Work Group participants complete a new GPA <https://kantarainitiative.org/gpa-signup/> at your earliest convenience. **Please note that if you do not complete a new GPA, you are still bound by the Code of Conduct. Thank you for your continued interest and participation in Kantara Initiative Work Groups! Please reach out to your WG Chairs or the Leadership Council with any questions or concerns. Best, -Amanda -- Amanda Gay | Work Groups and Membership [image: Logo, company name Description automatically generated] Phone: +1 571-475-8895 LinkedIn: @KantaraInitiative

1 0

Reminder: Comments on Conformance Documentation for tomorrow’s call
by John Wunderlich 17 Jun '25

17 Jun '25

Here are the documents: Doc: https://docs.google.com/document/d/1sDS2F7ndtGnc1jFY4yIfvsdpai1Y5s9ZFfFCVX5… Sheet: https://docs.google.com/spreadsheets/d/1kxUWyCnL-KKGBVzDsvLMujmDM7ItEPtlGs5… Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Draft conformance documentation available for review
by John Wunderlich 11 Jun '25

11 Jun '25

Hi; We had the weekly PEMC call today. You can find the minutes here: https://kantara.atlassian.net/wiki/x/AQDgPg. We had a brief chat about the No Phone Home petition. Then, Sal D'Agostino reported on the PEMC presentation he did at Identiverse. Despite being late in the afternoon of the last day, it was well attended, and there may be some new work group members. Finally, I walked people through the conformance documentation and sheet drafts. Principle 1 (Consent and Choice) has been drafted so the group can review format, presentation, and content. All members of the workgroup are encouraged to read and comment on this first tranche of work so that it can serve as a template for the other principles. Your Task (should you elect to participate): Look closely at the conformance document for principle one in the Google Doc. We are looking for feedback on the format, presentation, and content of the documentation. That plan is to deal with those comments at next week’s call. You can also look at the Google Sheet I’m working on for conformance testing. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

For your consideration
by John Wunderlich 30 May '25

30 May '25

Hi; I’m continuing to noodle in the PEMC Requirements Conformance Documentation. I have put the following under Principle 1: Consent and Choice Applying the Consent and Choice Principle to Mobile Credentials Where consent is the applicable basis for processing data, this principle mandates that organisations, including Issuers, Verifiers, and their respective Providers and Vendors, shall only process personal information with the explicit consent and choice of the individual Holder. This underscores the fundamental right of individuals (Holders) to control their personal information within the mobile credential ecosystem. Consent is only valid if the Holder has a genuine choice to allow or disallow the processing of their information. This means mechanisms must be in place for Holders to make informed decisions before or when any data processing occurs. These mechanisms should present distinguishable processing options, empowering the Holder to select their preferred level of data interaction. Considerations for Implementors: • Informed Decision-Making: Holders must be provided with clear, concise, and easily understandable information about what personal data is being collected, how it will be used, and with whom it might be shared. This information is crucial for them to make an informed choice. • Granular Choices: Where feasible, offer granular options rather than an all-or-nothing approach. This allows Holders to consent to specific processing activities while opting out of others, enhancing their control. • Timing of Consent: Consent must be obtained at or before the point of data processing. It should not be a retroactive justification for data already processed. • Opt-Out Mechanisms: Clear and accessible mechanisms must exist for Holders to opt out of data collection or usage practices. Their decisions to opt out must be respected and promptly implemented by the system. • Cognitive Overload Mitigation: While obtaining explicit consent is paramount, organisations must be mindful of potential "consent fatigue" or cognitive overload on Holders. Continuously prompting for consent for every minor interaction can diminish the effectiveness of the consent process itself. Stakeholders should explore and implement strategies to balance explicit consent requirements with user experience, ensuring that consent requests are meaningful and not burdensome. This involves setting preferences that persist or providing clear explanations of ongoing processing based on initial consent, with easy ways to review and revoke that consent. The Consent and Choice Principle for mobile credentials supports individual autonomy and transparency, ensuring that Holders are active participants in decisions regarding their data, rather than passive subjects of data processing. 2.1.1.1 Obtain Consent for Verifier Processing Description Applicability • Issuer and Vendors to Issuers. • Verifiers and Vendors to Verifiers. • Providers to Holders Pre-conditions Data Scope has been documented The Verifier should explicitly identify and document the personal information elements they intend to request or derive from a Holder's mobile credential. Without knowing what data is involved, it's impossible to design an appropriate consent mechanism or adequately inform the Holder. Purposes have been identified and documented. The Verifier should clearly define and document the specific, legitimate purpose(s) for collecting and processing each personal information element or group. Consent must be specific to the purpose(s) for collection. Vague or overly broad purposes invalidate consent. This also forms the basis of the Notice to the Holder. Notice Mechanism has been implemented. The Verifier has designed and implemented an evident, conspicuous, and easily understandable Notice. This Notice must be presented to the Holder before or at the point of requesting mobile credential data and must contain: • A description of the personal information attributes being requested/processed. • The purpose(s) for processing. • The identity of the Verifier (and any relevant third parties the data might be shared with, if applicable, along with purposes for that sharing). • Information on how the Holder can withdraw consent (if applicable to the specific interaction). • A link to a more detailed privacy policy, if appropriate Consent Mechanism has been implemented. The Verifier has designed and implemented an unambiguous mechanism for the Holder to provide affirmative consent after reviewing the Notice. This mechanism must: • Be separate from other terms or actions (e.g., not bundled with general terms of service acceptance unless directly related and clearly explained). • Offer an explicit "accept/agree" or equivalent affirmative action. • Allow the Holder to equally easily "decline/disagree" or abstain from providing the credential data without undue friction (beyond being unable to access the service that requires that data). There is a Consent Record System The Verifier has a reliable system or process to record the Holder's consent (e.g., timestamp, specific version of notice consented to, scope of consent given). There is a No-Consent Process The Verifier has a defined process for scenarios where a Holder withholds consent, ensuring that processing related to the denied consent does not occur and the Holder is appropriately informed of any consequences (e.g., inability to access a specific service). Staff Training The Verifier has been trained. Staff who engage with consent systems or processes (e.g., those involved in designing interaction flows, IT staff implementing the systems, and customer-facing staff, if applicable) are trained on this consent requirement and internal procedures. Tests Notice Availability & Timing Test Procedure: Initiate an interaction requiring credential data from the Verifier's system. Observation: Is a Notice presented before or at the point of data request? Is it easily accessible and readable? Success Criteria: Notice is timely and presented. Notice Content Adequacy Test Procedure: Review the content of the presented Notice. Observation: Does it accurately list the personal information to be processed? Does it clearly state the specific purpose(s)? Is the Verifier identified? Is the language understandable to a typical Holder? Success Criteria: Notice content is complete, accurate, and transparent as per pre-conditions. Consent Action Test Procedure: Interact with the consent mechanism. Observation: Does the system require an explicit, affirmative action from the Holder to signify consent (e.g., clicking "Agree," unchecking a pre-filled box is not sufficient)? Can the Holder easily decline? Success Criteria: Consent requires an explicit, affirmative action. Declining is straightforward. Data Processing Post-Consent Decision Test Procedure: Scenario A: Provide consent. Attempt to complete the transaction/interaction. Scenario B: Decline consent. Attempt to complete the transaction/interaction. Observation: Scenario A: Does the system process the Holder's data as described in the Notice? Scenario B: Does the system refrain from processing the Holder's personal information for the purpose for which consent was denied? Is the Holder informed of the outcome of declining (e.g., service unavailability)? Success Criteria: Data processing aligns with the Holder's consent decision. The system respects denial of consent. Consent Record Audit: Procedure: (If backend access or logs are available) After a successful consent interaction, attempt to locate the record of this consent. Observation: Is a record of consent stored? Does it contain relevant details (timestamp, scope)? Success Criteria: A verifiable record of consent exists. Test Results • Meets Requirement: The Verifier meets all test conditions for its use case. • Partially Meets Requirement: The Verifier meets at least 50% of the test conditions that apply for its use case Does Not Meet Requirement: The Verifier meets less than 50% of the test conditions that apply for its use case. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Fwd: GSA, General Services Administration (External) Daily Digest Bulletin
by John Wunderlich 30 May '25

30 May '25

Hi; Kay Chopard has asked me to share this with you. We are hoping that a number of people from Kantara will be able to attend. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN ---------- Forwarded message --------- From: General Services Administration <gsa(a)notify.gsa.gov> Date: Thu, May 29, 2025 at 4:44 AM Subject: GSA, General Services Administration (External) Daily Digest Bulletin To: <kay(a)kantarainitiative.org> You're Invited: Federal Mobile Driver’s License (mDL) Industry Day – July 14, 2025 05/28/2025 You're invited to attend the Federal Mobile Driver’s License (mDL) Industry Day on Monday, July 14, 2025, from 8:30 a.m. to 5 p.m. ET. This hybrid event will explore the growing role of mDLs in digital identity and how they can support your organization's mission. Join federal agencies, state governments, industry leaders, and identity experts to: • Learn what mDLs are and how they function • See real-world use cases in action at our vendor booths across sectors • Explore the current state of mDL adoption across the U.S. and globally • Understand how GSA can assist agencies in implementing mDL solutions Choose how you attend - registration required: In Person: Department of the Interior – Sidney Yates Auditorium, 1849 C Street NW, Washington, DC 🔗 Register for In-Person Attendance Virtual: 🔗 Register for Virtual Attendance For more information, contact us at fedmdlday(a)gsa.gov. Real-time closed captioning provided. ASL interpretation available upon request. Earn up to 8 CLPs for attending. Don't miss this unique opportunity to stay at the forefront of digital identity innovation. We look forward to seeing you there! Register Now REGISTER NOW: Upcoming June 6 Training on GSA eTools: The Tools Available for You! 05/28/2025 GSA eTools: The Tools Available for You! Live Webinar | June 6, 2025 | 1:00 PM ET Join us for OSDBU’s Small Business First Fridays training on “GSA eTools: The Tools Available for You!”.This webinar will introduce you to the agency’s eTools and methods for your business to gain an advantage in achieving acquisition efficiency. The General Services Administration (GSA) offers a suite of integrated eTools to make the acquisition process more efficient for small businesses. These complimentary eTools, including the GSA eLibrary, the Forecast of Contract Opportunities, and several others will help you expedite market research and more. This webinar is free and open to all industries. What You’ll Learn: • The roles and functions of GSA and OSDBU • How to successfully access and navigate GSA’s eTools • How to access subcontracting opportunities • How to understand and use contracting forecast information Time: Friday, June 6, 2025, 1:00 PM in Eastern Time (US and Canada) Where: Online (Registration: June 6 Webinar) Presenters: Jemeek Morris and Rob Reyes, GSA OSDBU This session is part of GSA OSDBU’s Small Business First Fridays training series, which delivers targeted educational sessions covering essential core topics. These sessions will provide actionable insights and strategies for vendors, equipping them with the knowledge and tools required to successfully navigate the complexities of the federal procurement landscape. **After registering, you will receive a confirmation email containing information about joining the training.** REGISTER NOW RELEASE -- GSA Hosts Industry Webinar on Revolutionary FAR Overhaul Initiative, Contract Consolidation 05/28/2025 For Immediate Release May 28, 2025 Contact: press(a)gsa.gov GSA Hosts Industry Webinar on Revolutionary FAR Overhaul Initiative, Contract Consolidation WASHINGTON — Today, the U.S. General Services Administration (GSA) hosted a webinar to engage more than 5,500 industry stakeholders on a major initiative to overhaul the Federal Acquisition Regulation (FAR). Senior officials discussed Executive Orders 14240 and 14275, highlighting efforts to consolidate contracting, streamline federal procurement, eliminate unnecessary regulations, and enhance value for taxpayers. In collaboration with the Office of Federal Procurement Policy (OFPP), GSA aims to simplify the acquisition process, reduce administrative burdens, and help agencies deliver better outcomes with fewer resources. “We are bringing GSA back to its founding mission of streamlining Federal operations, consolidating resources and delivering technology solutions that allow government agencies to focus on their core missions,” said GSA Acting Administrator Stephen Ehikian. “Our goal is to create the most modern, efficient, and technologically advanced government in the world. That starts with simplifying regulations, focusing on commercial solutions, and lowering the barriers to doing business with the government.” These changes are part of a bigger effort to make the government work more smoothly and save money. By cutting red tape and using smarter buying practices, GSA is helping agencies get what they need more easily and at better prices. “The commonsense changes we’re making via deregulation will benefit the government, taxpayers and our industry partners,” said Federal Acquisition Service Commissioner Josh Gruenbaum. “This initiative of simplicity directly complements our newly rolled out OneGov strategy which will enable the government to act with one federal wallet in an efficient manner, leveraging our buying power to get better prices for agencies and better value for taxpayers.” FAR Reform and Contract Consolidation In accordance with Executive Order 14275: Restoring Common Sense to Federal Procurement, GSA is working to remove non-statutory requirements while preserving fair competition, standardization, and safeguards against waste, fraud, and abuse. Key goals include prioritizing mission alignment, reducing acquisition timelines, embracing commercial solutions, and rewarding proven performance. Under President Trump’s guidance GSA will help execute the most significant update to federal purchasing rules in 40 years. As part of this effort, the Office of Management and Budget (OMB) has designated GSA as the executive agent for all Governmentwide Acquisition Contracts (GWACs). Federal agencies will now propose common needs for GSA to procure, helping to consolidate demand and streamline acquisition across government. “GSA is committed to supporting President Trump’s priorities around streamlining and modernizing the federal acquisition landscape. Any potential transitions will be carefully coordinated with our partner agencies and will prioritize continuity for industry partners and federal customers alike,” said GSA Senior Procurement Executive Jeffrey Koses. “Our shared goal is to reduce duplication and enhance efficiency. GSA is in a position to help save tens of billions of tax dollars for Americans.” FAR Deviations and Practitioner Tools OFPP and the FAR Council are also issuing targeted deviations to FAR Parts 1,10 and 34 to support more agile acquisition approaches. To support adoption, new resources will be available on Acquisition.gov, including: • Practitioner Albums: Curated learning tools for each FAR deviation. • FAR Companion Guide (Forthcoming): A reference to operationalize the revised FAR. • Category Buying Guide (Forthcoming): A tool to align purchases with category management principles. Acquisition.gov Enhancements Earlier this month, GSA and OFPP, along with the Department of Defense and NASA, launched the new FAR Overhaul page on Acquisition.gov. Today’s webinar included a walkthrough of the site, including how to sign up for updates and explore new FAR-related content. For more information, visit www.acquisition.gov. ### About GSA: GSA provides centralized procurement and shared services for the federal government. GSA manages a nationwide real estate portfolio of over 360 million rentable square feet, oversees more than $110 billion in products and services via federal contracts, and delivers technology services that serve millions of people across dozens of federal agencies. GSA’s mission is to deliver the best customer experience and value in real estate, acquisition, and technology services to the government and the American people. For more information, visit GSA.gov and follow us at @USGSA. STAY CONNECTED: SUBSCRIBER SERVICES: Manage Subscriptions | Unsubscribe All | Help This email was sent to kay(a)kantarainitiative.org on behalf of General Services Administration · 1800 F St. NW · Washington, DC 20405 · 866-606-8220 -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Today’s working call
by John Wunderlich 28 May '25

28 May '25

Hi; Here are the notes from today. The PEMC Requirements Conformance Worksheet is intended to be the working document for reporting on a conformance test. It’s a relatively simple worksheet to be completed when an organisation is ready to so a self-assessment or to be assessed by a third party. The WIP is a Google Sheet here. https://docs.google.com/spreadsheets/d/1kxUWyCnL-KKGBVzDsvLMujmDM7ItEPtlGs5… The PEMC Requirements Conformance Test Doc is the documentation to support the worksheet. It is intended to explain how to assess each requirement by providing descriptions, pre-conditions, and test for conformance. The WIP is a Google Doc here: https://docs.google.com/document/d/1sDS2F7ndtGnc1jFY4yIfvsdpai1Y5s9ZFfFCVX5… Here’s the first example from Principle 1 and including the first requirement. Feel free to comment in the Google documents. Principle 1: Consent and Choice The Holder must consent to the processing of their personal data. Applying the Consent and Choice Principle to Mobile Credentials Where consent is the applicable basis for processing data, this principle mandates that organisations, including Issuers, Verifiers, and their respective Providers and Vendors, shall only process personal information with the explicit consent and choice of the individual Holder. At its core, this principle emphasises individual autonomy. Consent is only valid if the Holder has a genuine choice to allow or disallow the processing of their information. This means mechanisms must be in place for Holders to make informed decisions before any data processing occurs. These mechanisms should present distinguishable processing options, empowering the Holder to select their preferred level of data interaction. Key Considerations for Implementation: Informed Decision-Making: Holders must be provided with clear, concise, and easily understandable information about what personal data is being collected, how it will be used, and with whom it might be shared. This information is crucial for them to make an informed choice. Granular Choices: Where feasible, offer granular options rather than an all-or-nothing approach. This allows Holders to consent to specific processing activities while opting out of others, enhancing their control. Timing of Consent: Consent must be obtained at or before the point of data processing. It should not be a retroactive justification for data already processed. Opt-Out Mechanisms: Clear and accessible mechanisms must exist for Holders to opt out of data collection or usage practices. Their decisions to opt out must be respected and promptly implemented by the system. Cognitive Overload Mitigation: While obtaining explicit consent is paramount, organisations must be mindful of potential "consent fatigue" or cognitive overload on Holders. Continuously prompting for consent for every minor interaction can diminish the effectiveness of the consent process itself. Stakeholders should explore and implement strategies to balance explicit consent requirements with user experience, ensuring that consent requests are meaningful and not unduly burdensome. This involves setting preferences that persist or providing clear explanations of ongoing processing based on initial consent, with easy ways to review and revoke that consent. By adhering to the Consent and Choice principle, organisations can build trust with Holders, foster greater transparency, and ensure their mobile credential solutions align with fundamental privacy rights. This approach moves beyond mere compliance, positioning privacy as a core tenet of the system's design and operation, where choice is the appropriate basis for legitimate processing. 1. Obtain Consent for Verifier Processing Description Obtaining consent for verifier processing requires that Verifiers secure valid consent from holders before processing any personal information received via a mobile credential. The act of a Holder presenting their mobile credential to a Verifier does not necessarily grant implicit permission for the Verifier to process the contained personal data for any purposes. Instead, the Verifier must determine if they must obtain the Holder's explicit consent in response to a clear notice provided by the Verifier to the Holder. Applicability • Issuer and Vendors to Issuers. • Verifiers and Vendors to Verifiers. • Providers to Holders Pre-conditions 1. Identify the Data Without knowing what data is involved, it's impossible to adequately design an appropriate consent mechanism or adequately inform the Holder. The Verifier should explicitly identify and document all personal information elements they intend to request or derive from a Holder's mobile credential. 1. Identify the Purposes Consent must be specific to the purpose. Vague or overly broad purposes invalidate consent. This also forms the basis of the Notice to the Holder. For each personal information element identified, the Verifier should clearly define and document the specific, legitimate purpose(s) for its collection and processing. 1. Design the Notice Mechanism The Verifier should design a system or process for presenting an evident, conspicuous, and easily understandable Notice to the Holder before or when requesting the mobile credential data. This notice should include: • A description of the personal information attributes being requested/processed. • The purpose(s) for processing. • The identity of the Verifier (and any relevant third parties the data might be shared with, if applicable, along with purposes for that sharing). • Information on how the Holder can withdraw consent (if applicable to the specific interaction). • A link to a more detailed privacy policy, if appropriate 1. Design the Consent Mechanism The Verifier should design an unambiguous mechanism for the Holder to actively signify their consent after being presented with the Notice. This mechanism should: • Be separate from other terms or actions (e.g., not bundled with general terms of service acceptance unless directly related and clearly explained). • Offer an explicit "accept/agree" or equivalent affirmative action. • Allow the Holder to equally easily "decline/disagree" or abstain from providing the credential data without undue friction (beyond being unable to access the service that requires that data). 1. System for Recording Consent The Verifier should have a reliable system or process to record the Holder's consent (e.g., timestamp, specific version of notice consented to, scope of consent). 1. Processing for Handling Lack of Consent The Verifier should have a defined process for what happens if a Holder does not consent. This usually means the specific processing (and potentially the related service) cannot proceed. 1. Staff Training and Awareness Relevant staff (e.g., developers, product managers, legal/compliance, customer-facing personnel) should be trained on this consent requirement and the Verifier's processes for upholding it. Test conditions • Notice Presentation Test Simulate a Holder interaction: • Is a Notice presented to the Holder before or when requesting credential data? • Is the Notice easy to find and read? • Does the Notice appear consistently across platforms or systems? Success: The Notice is presented as required • Notice Content Review Examine the content of the Notice: 1. Does the Notice accurately describe the personal information attributes processed? 2. Does the Notice state the purpose(s) for processing? 3. Is the Notice language easy for a typical Holder to understand? 4. Does the Notice identify the Verifier? Success: The Notice content is complete, accurate, and understandable. The Notice aligns with data elements and purposes. • Consent Functionality Test Interact with the consent mechanism: • Is there an explicit, affirmative action required from the Holder to indicate consent (e.g., a checkbox that is unchecked by default, a button to "Agree")? • Is it equally easy to decline or withhold consent? • Does the system prevent processing if consent is not given? • Can the Holder proceed with a "decline" option, and does the system respect this choice by not processing the data for that purpose? Success: The consent mechanism requires an affirmative act, allows for refusal, and the system respects the Holder's choice. • Consent Record Verification Test • After a Holder gives consent, is a record of this consent generated and stored? • Does the record include relevant details (e.g., what was consented to, timestamp)? Success: A verifiable record of consent is created. • Test Privacy Defaults Examine the consent interface: • Are consent options (e.g., checkboxes) pre-filled or pre-selected to indicate agreement? Success: Consent requires an active opt-in; no pre-checked boxes or reliance on inaction as consent. • Data Processing Audit After an interaction where consent was (or was not) given: • if consent was given, verify that only the data elements for which consent was obtained are processed, and only for the stated purposes. • If consent was not given, verify that the Verifier does not process the Holder's personal information from the mobile credential for the requested purpose. Success: Data processing (or lack thereof) aligns with the Holder's consent (or withheld). • Withdrawal of Consent Test If the Verifier offers a mechanism for consent withdrawal: • Is this mechanism easily accessible and usable by the Holder? • Does withdrawing consent effectively stop further processing (for which consent was the basis)? Success: Withdrawal mechanism functions as described and effectively revokes consent. Test Results • Meets Requirement: The Verifier meets all test conditions for its use case. • Partially Meets Requirement: The Verifier meets at least 50% of the test conditions that apply for its use case • Does Not Meet Requirement: The Verifier meets less than 50% of the test conditions that apply for its use case. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Apologies for the last minute cancellation.
by john＠wunderlich.ca 21 May '25

21 May '25

1 0

Fwd: IIW40 Book of Proceedings! 🐝 Order a T-shirt! 🐶
by John Wunderlich 20 May '25

20 May '25

FYI Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN ---------- Forwarded message ---------- From: Phil Windley <phil(a)windley.org> Date: May 20, 2025 at 11:50 -0400 To: john(a)wunderlich.ca Subject: IIW40 Book of Proceedings! 🐝 Order a T-shirt! 🐶 > Book of Proceedings - Next IIW Dates > 147 Sessions * Notes Submitted 106 > Access the IIWXL Book of Proceedings Here > Full Session List * Notes * Photos * Identity Comic Strips * Demo Hour * Upcoming Regional Events * Links to Doc's Photos * and More > > Registration for Internet Identity Workshop XLI will open in late May > IIWXLI #41 October 28 - 30, 2025 > IIWXLII #42 Late April. 2026 > Order Your IIW XL or IIW Classic TShirts / Hoodies > via Amazon’s Merch on Demand > There are two IIW XL t-shirt designs: 1st HERE and 2nd HERE > Or get a Classic Logo (including original 2005) HERE > Limited styles are also available on the: > Japanese, Italian, UK, French, Spanish, and German Amazon stores. > Email Phil @ phil(a)windley.org with your request and we'll send you a link! > Thank YOU Again IIWXL Sponsors - We couldn't do it without you! > Copyright © 2025 IIW Foundation, All rights reserved. > > Want to change how you receive these emails? > You can update your preferences or unsubscribe from this list -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0