- Wg-pemc - mailman.kantarainitiative.org

Next week’s PEMC cancelled
by John Wunderlich 11 Apr '24

11 Apr '24

Hi; Yesterday’s meeting was sparsely attended, so I did not call it to order. We did have an interesting conversation, one part of which was about the ability of small organization Verifiers to be able to meet requirements. One option is to make the provider of verifier capabilities (hardware and/or software) accountable through their licensing agreement to use their equipment. This struck me as similar or aligned with the way that payment terminal providers require certain controls of their retailers. Looking forward to your thoughts on the matter. Next week is the Internet Identity Workshop, so I have cancelled next week’s meeting. See you on the 24th at the next call. Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Deck
by John Wunderlich 03 Apr '24

03 Apr '24

Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Prior meeting still open. Try this instead
by John Wunderlich 03 Apr '24

03 Apr '24

Here’s my own Zoom https://us06web.zoom.us/j/7325916646 Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Important discussion tomorrow
by John Wunderlich 03 Apr '24

03 Apr '24

Dear all, I would like to extend my invitation to all the members of the PEMC to join tomorrow's call, as it is important that we provide our feedback to Kantara. Eve Mahler has been guiding the Kantara board through a nano-visions exercise, and they are hoping to receive inputs from every group to discuss on the next Leadership Council Monthly call. I will share Eve's deck during the call tomorrow and if you can participate we can brainstorm the PEMC response. Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 6

Inclusive purpose and consent document
by Tom Jones 02 Apr '24

02 Apr '24

I am sharing a document under development by the Resilience Identifiers for Underserved Populations to ensure that the work product of the two work groups stays aligned. We have focused on the data that needs to flow from the Verifier to the User Device in order to ensure that the data displayed to the holder will be appropriate to the purpose specified and so that the holder can make an informed consent for themselves or for the subject that has delegated them authority to make a decision for that subject. It is expected that this data will flow from the verifier to the user's device so that the device can make the decision about the appropriate user agent (or wallet) to handle the request. It is up to the device and the user agent to form the UX for holder consent. Other arrangements of the device and agent are, of course, possible. Please let us know if there is any particular action RIUP should take to help assure alignment. https://docs.google.com/document/d/1n7HobJ6QTsNld5rn1uuIiNw0A__L44ug/edit?u… ..tom

1 0

adoption of document for purpose and consent
by Tom Jones 20 Mar '24

20 Mar '24

This document was adopted for development by the Reliable Identifier for the Underserved Populations (RIUP) Kantara work group. This is just an informative notice and does require any action by the PEMC. But feedback from the members would be highly appreciated. https://docs.google.com/document/d/1n7HobJ6QTsNld5rn1uuIiNw0A__L44ug/edit?u… ..tom

1 0

making a difference
by Tom Jones 06 Mar '24

06 Mar '24

I am having trouble getting privacy enhancing techniques into the wallet-verifier communications in OpenID and OWF. If we don't have a doc (even a draft) to show the standards makers soon it will be too late to make a difference. I have included an attachment that shows the problem i am having even getting a user friendly name of the verifier into the wallet. ..tom

1 0

interesting view on observability and purpose from EU
by Tom Jones 01 Mar '24

01 Mar '24

We now have new requirements - observability and purpose - it seems that the idea of a general purpose wallet has been effectively eliminated in the EU and by those states that mandate their own wallets for their own creds. Statement by the Commission on unobservability on the occasion of the adoption of Regulation 2024/... + The Commission welcomes the agreement reached, which in its view, confirms that this amending Regulation does not allow for the processing of personal data contained in or arising from the use of the European Digital Identity Wallet by the Wallet providers for other purposes than delivering wallet services. The Commission also welcomes the inclusion of the concept of *unobservability in Recital (11c) of the draft amending Regulation, which should prevent wallet providers from collecting and seeing the details of user’s day-to-day transactions.* The Commission is of the view that this concept means that there should not be correlation of data across different services for the purposes of user tracking or tracing or for determining, analysing and predicting personal behaviour, interests or habits. At the same time, the Commission acknowledges that, in full compliance with Regulation (EU) 2016/679, the providers of European Digital Identity Wallets may access certain categories of personal data with the user’s explicit consent, such as in order to ensure continuity in the provision of wallet services or to protect users from disruptions in their provision.* That data should be limited to what is necessary for each specific purpose.’ * AM_Ple_LegStatOther (europa.eu) <https://www.europarl.europa.eu/doceo/document/A-9-2023-0038-AM-007-007_EN.p…>

2 1

to enhance privacy we need to focus on the link between the verifier and the user's wallet
by Tom Jones 28 Feb '24

28 Feb '24

Here is a doc I am pushing thru a variety of standards. https://docs.google.com/document/d/12uuiEEkfnYoBwphkiNHQmFVH0H24gl3h/edit?u… ..tom

1 0

Reason for request
by Jordaan, Loffie 23 Feb '24

23 Feb '24

Tom, In yesterday's meeting, you suggested (if my understanding is correct) that the reason for any request from a verifier can logically be simplified into the following structure: Purpose A Required field 1 Required field 2 Required field 3 Purpose B Required field 1 Required field 4 Required field 5 An underlying assumption is that for any purpose there are never optional fields. Consider the following use cases: 1. A verifier offers patrons to enter into a lucky draw. Local legislation requires a name and address to be recorded. The verifier would like to allow entrants the option of also providing an email address that will only be used to notify the patron in case of winning. 2. A verifier offers to provide a patron with promotional material. At minimum, the verifier needs the patron's email address. When enrolling in the service, the patron can optionally provide a name. 3. In order to open a new bank account online, a bank needs Name and DOB. The customer has the option to also provide a DLN for a quicker account creation turnaround time (since the bank needs less time for their background checks). 4. An airport security checkpoint requires a person's portrait image, name and DOB. In addition, if the customer has a commercial driver's license with a Hazmat endorsement, the customer can go through a faster lane (since the FBI has already checked the person out). The security checkpoint would also like to collect zip code information (to be anonymized) for research purposes. Customer's do not have to provide zip code information. Also playing into this is the need for cross-jurisdictional interoperability. This means that the purpose must be conveyed using a code and not via freeform text. (Purpose definitions will not include the fields associated with them; fields required for a given purpose is identified in a request at transaction time.) I see the following options: 1. Create very narrowly defined purposes for the examples above. This would require the creation of a very large and likely incomplete set of coded purposes. (The option of only allowing a single purpose per transaction would be an arguably worse flavor of this option.) 2. Define broader standardized purposes, and allow each purpose to contain mandatory and optional fields (identified in the request at transaction time). 3. ? Thoughts anyone? Thanks. [Logo, company name Description automatically generated]<http://www.aamva.org/> Loffie Jordaan Business Solutions Architect Phone: 703.908.5864 Email: ljordaan(a)aamva.org<mailto:ljordaan@aamva.org> aamva.org<http://www.aamva.org/> [Icon Description automatically generated]<https://www.facebook.com/AAMVA/>[A picture containing text, wheel, gear Description automatically generated]<https://twitter.com/AAMVAConnection>[Icon Description automatically generated with medium confidence]<https://www.youtube.com/channel/UCrW3jQf3p_25zeK9EQbCrAA>[A picture containing graphical user interface Description automatically generated]<https://www.flickr.com/people/aamva/>[Icon Description automatically generated]<https://www.linkedin.com/company/aamva/>[Icon Description automatically generated]<https://www.instagram.com/aamvaconnection/>[Icon Description automatically generated]<https://aamvacast.podbean.com/>

4 5