- Wg-pemc - mailman.kantarainitiative.org

Reminder of PEMC all in an hour
by John Wunderlich 23 Jul '25

23 Jul '25

We will continue to review the Conformance Doc which is currently up to Principle 7. Even if you can't make the call, I would appreciate comments in the doc. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Re: Insights from Digital Benefits Network
by Salvatore D'Agostino 18 Jul '25

18 Jul '25

Thanks for sharing, Jorge. best, Sal Get Outlook for iOS<https://aka.ms/o0ukef> ________________________________ From: Jorge Flores <jorge(a)entidad.io> Sent: Friday, July 18, 2025 12:57:21 PM To: wg-riup <wg-riup(a)kantarainitiative.org> Subject: [WG-RIUP] Insights from Digital Benefits Network I attended my first meeting at the Digital Identity Community of Practice sponsored by the Digital Benefits Network<https://beeckcenter.georgetown.edu/projects/digital-benefits-network/>. I’m sharing slides that were presented by Colorado Peak and Public Policy Lab + the DBN over insights from (public benefit) applicant feedback and experiences with authentication and proofing. [signature_4191920133] Jorge Flores | Co-founder and CTO | https://www.entidad.io<https://www.entidad.io/> | Book time with me: 30 minutes meeting <https://outlook.office.com/bookwithme/user/0ecdfe2ced8e4bf9a3f895d60556df0c…>

1 0

Musings of a Trust Architect: When Technical Standards Meet Geopolitical Reality - Blockchain Commons
by John Wunderlich 16 Jul '25

16 Jul '25

https://www.blockchaincommons.com/musings/gdc25/ Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Reminder: No call today
by John Wunderlich 02 Jul '25

02 Jul '25

This week is both Canada Day 🇨🇦 and the 4th 🇺🇸 so no call today. Hope you join the call next week. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

requirements
by Tom Jones 18 Jun '25

18 Jun '25

I think we need to be more prescriptive on requirements. I think we need minimum requirements. I would change Test Results - Meets Requirement: The Verifier meets all test conditions for its use case. - Partially Meets Requirement: The Verifier meets at least 50% of the test conditions for its use case.Does Not Meet Requirement: The Verifier meets less than 50% of the test conditions for its use case. to Test Results - Meets Requirement: The Verifier meets all test conditions for its use case. - Meets Minimum Requirement: The Verifier meets all of the minimal test conditions for all use cases that it is designed to handle.Does Not Meet Requirement: The Verifier meets less than 50% of the test conditions for its use case. Peace ..tom jones

2 1

The wallet demarcation problem: developing a taxonomy for classifying digital wallets
by John Wunderlich 18 Jun '25

18 Jun '25

FYI: https://proceedings.open.tudelft.nl/DGO2025/article/view/1039 Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Notice - Release of Work Group Participant Code of Conduct
by Amanda Gay 17 Jun '25

17 Jun '25

Dear WG Participants: This email is to inform you that the Work Group Participant Code of Conduct <https://kantara.atlassian.net/wiki/spaces/LC/pages/1055227915/Code+of+Condu…> has been passed by the Leadership Council and is in effect immediately – all group participation is now subject to the Code of Conduct. Reminder: Participation in Kantara Work Groups is subject to all Kantara policies <https://kantara.atlassian.net/wiki/spaces/GI/pages/1081775/All+Policies>. The Code of Conduct is now explicitly included in the Group Participation Agreement (GPA) for transparency as part of the applicable policies for Work Group participation. We request that Work Group participants complete a new GPA <https://kantarainitiative.org/gpa-signup/> at your earliest convenience. **Please note that if you do not complete a new GPA, you are still bound by the Code of Conduct. Thank you for your continued interest and participation in Kantara Initiative Work Groups! Please reach out to your WG Chairs or the Leadership Council with any questions or concerns. Best, -Amanda -- Amanda Gay | Work Groups and Membership [image: Logo, company name Description automatically generated] Phone: +1 571-475-8895 LinkedIn: @KantaraInitiative

1 0

Reminder: Comments on Conformance Documentation for tomorrow’s call
by John Wunderlich 17 Jun '25

17 Jun '25

Here are the documents: Doc: https://docs.google.com/document/d/1sDS2F7ndtGnc1jFY4yIfvsdpai1Y5s9ZFfFCVX5… Sheet: https://docs.google.com/spreadsheets/d/1kxUWyCnL-KKGBVzDsvLMujmDM7ItEPtlGs5… Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Draft conformance documentation available for review
by John Wunderlich 11 Jun '25

11 Jun '25

Hi; We had the weekly PEMC call today. You can find the minutes here: https://kantara.atlassian.net/wiki/x/AQDgPg. We had a brief chat about the No Phone Home petition. Then, Sal D'Agostino reported on the PEMC presentation he did at Identiverse. Despite being late in the afternoon of the last day, it was well attended, and there may be some new work group members. Finally, I walked people through the conformance documentation and sheet drafts. Principle 1 (Consent and Choice) has been drafted so the group can review format, presentation, and content. All members of the workgroup are encouraged to read and comment on this first tranche of work so that it can serve as a template for the other principles. Your Task (should you elect to participate): Look closely at the conformance document for principle one in the Google Doc. We are looking for feedback on the format, presentation, and content of the documentation. That plan is to deal with those comments at next week’s call. You can also look at the Google Sheet I’m working on for conformance testing. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

For your consideration
by John Wunderlich 30 May '25

30 May '25

Hi; I’m continuing to noodle in the PEMC Requirements Conformance Documentation. I have put the following under Principle 1: Consent and Choice Applying the Consent and Choice Principle to Mobile Credentials Where consent is the applicable basis for processing data, this principle mandates that organisations, including Issuers, Verifiers, and their respective Providers and Vendors, shall only process personal information with the explicit consent and choice of the individual Holder. This underscores the fundamental right of individuals (Holders) to control their personal information within the mobile credential ecosystem. Consent is only valid if the Holder has a genuine choice to allow or disallow the processing of their information. This means mechanisms must be in place for Holders to make informed decisions before or when any data processing occurs. These mechanisms should present distinguishable processing options, empowering the Holder to select their preferred level of data interaction. Considerations for Implementors: • Informed Decision-Making: Holders must be provided with clear, concise, and easily understandable information about what personal data is being collected, how it will be used, and with whom it might be shared. This information is crucial for them to make an informed choice. • Granular Choices: Where feasible, offer granular options rather than an all-or-nothing approach. This allows Holders to consent to specific processing activities while opting out of others, enhancing their control. • Timing of Consent: Consent must be obtained at or before the point of data processing. It should not be a retroactive justification for data already processed. • Opt-Out Mechanisms: Clear and accessible mechanisms must exist for Holders to opt out of data collection or usage practices. Their decisions to opt out must be respected and promptly implemented by the system. • Cognitive Overload Mitigation: While obtaining explicit consent is paramount, organisations must be mindful of potential "consent fatigue" or cognitive overload on Holders. Continuously prompting for consent for every minor interaction can diminish the effectiveness of the consent process itself. Stakeholders should explore and implement strategies to balance explicit consent requirements with user experience, ensuring that consent requests are meaningful and not burdensome. This involves setting preferences that persist or providing clear explanations of ongoing processing based on initial consent, with easy ways to review and revoke that consent. The Consent and Choice Principle for mobile credentials supports individual autonomy and transparency, ensuring that Holders are active participants in decisions regarding their data, rather than passive subjects of data processing. 2.1.1.1 Obtain Consent for Verifier Processing Description Applicability • Issuer and Vendors to Issuers. • Verifiers and Vendors to Verifiers. • Providers to Holders Pre-conditions Data Scope has been documented The Verifier should explicitly identify and document the personal information elements they intend to request or derive from a Holder's mobile credential. Without knowing what data is involved, it's impossible to design an appropriate consent mechanism or adequately inform the Holder. Purposes have been identified and documented. The Verifier should clearly define and document the specific, legitimate purpose(s) for collecting and processing each personal information element or group. Consent must be specific to the purpose(s) for collection. Vague or overly broad purposes invalidate consent. This also forms the basis of the Notice to the Holder. Notice Mechanism has been implemented. The Verifier has designed and implemented an evident, conspicuous, and easily understandable Notice. This Notice must be presented to the Holder before or at the point of requesting mobile credential data and must contain: • A description of the personal information attributes being requested/processed. • The purpose(s) for processing. • The identity of the Verifier (and any relevant third parties the data might be shared with, if applicable, along with purposes for that sharing). • Information on how the Holder can withdraw consent (if applicable to the specific interaction). • A link to a more detailed privacy policy, if appropriate Consent Mechanism has been implemented. The Verifier has designed and implemented an unambiguous mechanism for the Holder to provide affirmative consent after reviewing the Notice. This mechanism must: • Be separate from other terms or actions (e.g., not bundled with general terms of service acceptance unless directly related and clearly explained). • Offer an explicit "accept/agree" or equivalent affirmative action. • Allow the Holder to equally easily "decline/disagree" or abstain from providing the credential data without undue friction (beyond being unable to access the service that requires that data). There is a Consent Record System The Verifier has a reliable system or process to record the Holder's consent (e.g., timestamp, specific version of notice consented to, scope of consent given). There is a No-Consent Process The Verifier has a defined process for scenarios where a Holder withholds consent, ensuring that processing related to the denied consent does not occur and the Holder is appropriately informed of any consequences (e.g., inability to access a specific service). Staff Training The Verifier has been trained. Staff who engage with consent systems or processes (e.g., those involved in designing interaction flows, IT staff implementing the systems, and customer-facing staff, if applicable) are trained on this consent requirement and internal procedures. Tests Notice Availability & Timing Test Procedure: Initiate an interaction requiring credential data from the Verifier's system. Observation: Is a Notice presented before or at the point of data request? Is it easily accessible and readable? Success Criteria: Notice is timely and presented. Notice Content Adequacy Test Procedure: Review the content of the presented Notice. Observation: Does it accurately list the personal information to be processed? Does it clearly state the specific purpose(s)? Is the Verifier identified? Is the language understandable to a typical Holder? Success Criteria: Notice content is complete, accurate, and transparent as per pre-conditions. Consent Action Test Procedure: Interact with the consent mechanism. Observation: Does the system require an explicit, affirmative action from the Holder to signify consent (e.g., clicking "Agree," unchecking a pre-filled box is not sufficient)? Can the Holder easily decline? Success Criteria: Consent requires an explicit, affirmative action. Declining is straightforward. Data Processing Post-Consent Decision Test Procedure: Scenario A: Provide consent. Attempt to complete the transaction/interaction. Scenario B: Decline consent. Attempt to complete the transaction/interaction. Observation: Scenario A: Does the system process the Holder's data as described in the Notice? Scenario B: Does the system refrain from processing the Holder's personal information for the purpose for which consent was denied? Is the Holder informed of the outcome of declining (e.g., service unavailability)? Success Criteria: Data processing aligns with the Holder's consent decision. The system respects denial of consent. Consent Record Audit: Procedure: (If backend access or logs are available) After a successful consent interaction, attempt to locate the record of this consent. Observation: Is a record of consent stored? Does it contain relevant details (timestamp, scope)? Success Criteria: A verifiable record of consent exists. Test Results • Meets Requirement: The Verifier meets all test conditions for its use case. • Partially Meets Requirement: The Verifier meets at least 50% of the test conditions that apply for its use case Does Not Meet Requirement: The Verifier meets less than 50% of the test conditions that apply for its use case. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0