Hi;

Here are the notes from today. The PEMC Requirements Conformance Worksheet is intended to be the working document for reporting on a conformance test. It’s a relatively simple worksheet to be completed when an organisation is ready to so a self-assessment or to be assessed by a third party. The WIP is a Google Sheet here. https://docs.google.com/spreadsheets/d/1kxUWyCnL-KKGBVzDsvLMujmDM7ItEPtlGs5n0XEVgZU/edit?usp=sharing

The PEMC Requirements Conformance Test Doc is the documentation to support the worksheet. It is intended to explain how to assess each requirement by providing descriptions, pre-conditions, and test for conformance. The WIP is a Google Doc here: https://docs.google.com/document/d/1sDS2F7ndtGnc1jFY4yIfvsdpai1Y5s9ZFfFCVX59Ahw/edit?usp=sharing 

Here’s the first example from Principle 1 and including the first requirement. Feel free to comment in the Google documents.

Principle 1: Consent and Choice
The Holder must consent to the processing of their personal data.

Applying the Consent and Choice Principle to Mobile Credentials
Where consent is the applicable basis for processing data, this principle mandates that organisations, including Issuers, Verifiers, and their respective Providers and Vendors, shall only process personal information with the explicit consent and choice of the individual Holder.
At its core, this principle emphasises individual autonomy. Consent is only valid if the Holder has a genuine choice to allow or disallow the processing of their information. This means mechanisms must be in place for Holders to make informed decisions before any data processing occurs. These mechanisms should present distinguishable processing options, empowering the Holder to select their preferred level of data interaction.
Key Considerations for Implementation:
Informed Decision-Making: Holders must be provided with clear, concise, and easily understandable information about what personal data is being collected, how it will be used, and with whom it might be shared. This information is crucial for them to make an informed choice.
Granular Choices: Where feasible, offer granular options rather than an all-or-nothing approach. This allows Holders to consent to specific processing activities while opting out of others, enhancing their control.
Timing of Consent: Consent must be obtained at or before the point of data processing. It should not be a retroactive justification for data already processed.
Opt-Out Mechanisms: Clear and accessible mechanisms must exist for Holders to opt out of data collection or usage practices. Their decisions to opt out must be respected and promptly implemented by the system.
Cognitive Overload Mitigation: While obtaining explicit consent is paramount, organisations must be mindful of potential "consent fatigue" or cognitive overload on Holders. Continuously prompting for consent for every minor interaction can diminish the effectiveness of the consent process itself. Stakeholders should explore and implement strategies to balance explicit consent requirements with user experience, ensuring that consent requests are meaningful and not unduly burdensome. This involves setting preferences that persist or providing clear explanations of ongoing processing based on initial consent, with easy ways to review and revoke that consent.
By adhering to the Consent and Choice principle, organisations can build trust with Holders, foster greater transparency, and ensure their mobile credential solutions align with fundamental privacy rights. This approach moves beyond mere compliance, positioning privacy as a core tenet of the system's design and operation, where choice is the appropriate basis for legitimate processing.