October 2015 - WG-UMA - mailman.kantarainitiative.org

Re: [WG-UMA] [projectvrm] Re: The Death of Safe Harbor is the Ultimate VRM and UMA Legal Opportunity
by Neiditz, Jon 06 Oct '15

06 Oct '15

You cannot give an irrevocable consent, because that would be attempting to alienate a “human right.” Jon Neiditz Kilpatrick Townsend & Stockton LLP Suite 2800 | 1100 Peachtree Street NE | Atlanta, GA 30309-4528 office 404 815 6004 | cell 678-427-7809 | fax 770 234 6341 jneiditz(a)kilpatricktownsend.com<mailto:jneiditz@kilpatricktownsend.com> | My Profile<http://www.kilpatricktownsend.com/en/Who%20We%20Are/Professionals/N/Neiditz…> | vCard<http://www.kilpatricktownsend.com/_assets/vcards/professionals/NeiditzJonat…> [cid:image005.png@01D10029.7D550CC0]<https://www.linkedin.com/in/informationmanagementlaw> [cid:image006.png@01D10029.7D550CC0] <http://www.twitter.com/jonneiditz> From: Mike O'Neill [mailto:michael.oneill@baycloud.com] Sent: Tuesday, October 06, 2015 11:21 AM To: 'James Hazard' Cc: Neiditz, Jon; 'WG UMA'; 'ProjectVRM list' Subject: RE: [projectvrm] Re: [WG-UMA] The Death of Safe Harbor is the Ultimate VRM and UMA Legal Opportunity Correct. Consent must be “freely given, specific and informed”. Even if the basis is “legitimate interest” they still have the right to opt-out, by automated means (if that is still in the GDPR). From: James Hazard [mailto:james.g.hazard@gmail.com] Sent: 06 October 2015 15:48 To: Mike O'Neill <michael.oneill(a)baycloud.com<mailto:michael.oneill@baycloud.com>> Cc: Neiditz, Jon <JNeiditz(a)kilpatricktownsend.com<mailto:JNeiditz@kilpatricktownsend.com>>; WG UMA <wg-uma(a)kantarainitiative.org<mailto:wg-uma@kantarainitiative.org>>; ProjectVRM list <projectvrm(a)eon.law.harvard.edu<mailto:projectvrm@eon.law.harvard.edu>> Subject: Re: [projectvrm] Re: [WG-UMA] The Death of Safe Harbor is the Ultimate VRM and UMA Legal Opportunity So, roughly, ?/ "I consent to You taking the Specified Personal Information to the US. You agree to: protect it, use it only for Specified Purposes, inform me of Leaks, and Destroy it when no longer needed for the Specified Purposes or I ask You to." Can a person give non-revocable consent to use of data within EU? /? On Tue, Oct 6, 2015 at 4:21 PM, Mike O'Neill <michael.oneill(a)baycloud.com<mailto:michael.oneill@baycloud.com>> wrote: Consent must be “freely given”, so IMO it follows that it must be revocable (with a “sunset”). Article 29 and many DPAs also have said that. From: James Hazard [mailto:james.g.hazard@gmail.com<mailto:james.g.hazard@gmail.com>] Sent: 06 October 2015 14:53 To: Neiditz, Jon <JNeiditz(a)kilpatricktownsend.com<mailto:JNeiditz@kilpatricktownsend.com>> Cc: WG UMA <wg-uma(a)kantarainitiative.org<mailto:wg-uma@kantarainitiative.org>>; ProjectVRM list <projectvrm(a)eon.law.harvard.edu<mailto:projectvrm@eon.law.harvard.edu>> Subject: [projectvrm] Re: [WG-UMA] The Death of Safe Harbor is the Ultimate VRM and UMA Legal Opportunity Do you mean that consent of the person permits transfer of data, but consent is necessarily revocable and data must be destroyed? On Oct 6, 2015 3:40 PM, "Neiditz, Jon" <JNeiditz(a)kilpatricktownsend.com<mailto:JNeiditz@kilpatricktownsend.com>> wrote: Why? The Advocate General's opinion and the Court's decision both turn on the inability of Safe Harbor to prevent surveillance. NO permitted basis for data transfer prevents surveillance, not Model Clauses, not Binding Corporate Rules (BCRs). Logically, if probably not in immediate corporate and EU national practice, the only bulletproof basis for data transfer to the US is now the ever-so-revocable CONSENT, which presumes no fictitious protection from surveillance. See also: https://www.linkedin.com/pulse/good-morning-safe-harbor-dead-what-does-mean… Your thoughts? Jon Neiditz Kilpatrick Townsend & Stockton LLP Suite 2800 | 1100 Peachtree Street NE | Atlanta, GA 30309-4528 office 404 815 6004<tel:404%20815%206004> | cell 678-427-7809<tel:678-427-7809> | fax 770 234 6341<tel:770%20234%206341> jneiditz(a)kilpatricktownsend.com<mailto:jneiditz@kilpatricktownsend.com> | www.kilpatricktownsend.com<http://www.kilpatricktownsend.com> ________________________________ Confidentiality Notice: This communication constitutes an electronic communication within the meaning of the Electronic Communications Privacy Act, 18 U.S.C. Section 2510, and its disclosure is strictly limited to the recipient intended by the sender of this message. This transmission, and any attachments, may contain confidential attorney-client privileged information and attorney work product. If you are not the intended recipient, any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. Please contact us immediately by return e-mail or at 404 815 6500<tel:404%20815%206500>, and destroy the original transmission and its attachments without reading or saving in any manner. ________________________________ ***DISCLAIMER*** Per Treasury Department Circular 230: Any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein. _______________________________________________ WG-UMA mailing list WG-UMA(a)kantarainitiative.org<mailto:WG-UMA@kantarainitiative.org> http://kantarainitiative.org/mailman/listinfo/wg-uma -- @commonaccord

1 0

Re: [WG-UMA] [projectvrm] Re: The Death of Safe Harbor is the Ultimate VRM and UMA Legal Opportunity
by James Hazard 06 Oct '15

06 Oct '15

So, roughly, ?/ "I consent to You taking the Specified Personal Information to the US. You agree to: protect it, use it only for Specified Purposes, inform me of Leaks, and Destroy it when no longer needed for the Specified Purposes or I ask You to." Can a person give non-revocable consent to use of data within EU? /? On Tue, Oct 6, 2015 at 4:21 PM, Mike O'Neill <michael.oneill(a)baycloud.com> wrote: > Consent must be “freely given”, so IMO it follows that it must be > revocable (with a “sunset”). Article 29 and many DPAs also have said that. > > > > > > *From:* James Hazard [mailto:james.g.hazard@gmail.com] > *Sent:* 06 October 2015 14:53 > *To:* Neiditz, Jon <JNeiditz(a)kilpatricktownsend.com> > *Cc:* WG UMA <wg-uma(a)kantarainitiative.org>; ProjectVRM list < > projectvrm(a)eon.law.harvard.edu> > *Subject:* [projectvrm] Re: [WG-UMA] The Death of Safe Harbor is the > Ultimate VRM and UMA Legal Opportunity > > > > Do you mean that consent of the person permits transfer of data, but > consent is necessarily revocable and data must be destroyed? > > On Oct 6, 2015 3:40 PM, "Neiditz, Jon" <JNeiditz(a)kilpatricktownsend.com> > wrote: > > Why? > > The Advocate General's opinion and the Court's decision both turn on the > inability of Safe Harbor to prevent surveillance. NO permitted basis for > data transfer prevents surveillance, not Model Clauses, not Binding > Corporate Rules (BCRs). Logically, if probably not in immediate corporate > and EU national practice, the only bulletproof basis for data transfer to > the US is now the ever-so-revocable CONSENT, which presumes no fictitious > protection from surveillance. > > See also: > https://www.linkedin.com/pulse/good-morning-safe-harbor-dead-what-does-mean… > > Your thoughts? > > Jon Neiditz > Kilpatrick Townsend & Stockton LLP > Suite 2800 | 1100 Peachtree Street NE | Atlanta, GA 30309-4528 > office 404 815 6004 | cell 678-427-7809 | fax 770 234 6341 > jneiditz(a)kilpatricktownsend.com | www.kilpatricktownsend.com > > > ________________________________ > > Confidentiality Notice: > This communication constitutes an electronic communication within the > meaning of the Electronic Communications Privacy Act, 18 U.S.C. Section > 2510, and its disclosure is strictly limited to the recipient intended by > the sender of this message. This transmission, and any attachments, may > contain confidential attorney-client privileged information and attorney > work product. If you are not the intended recipient, any disclosure, > copying, distribution or use of any of the information contained in or > attached to this transmission is STRICTLY PROHIBITED. Please contact us > immediately by return e-mail or at 404 815 6500, and destroy the original > transmission and its attachments without reading or saving in any manner. > > ________________________________ > > ***DISCLAIMER*** Per Treasury Department Circular 230: Any U.S. federal > tax advice contained in this communication (including any attachments) is > not intended or written to be used, and cannot be used, for the purpose of > (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, > marketing or recommending to another party any transaction or matter > addressed herein. > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > http://kantarainitiative.org/mailman/listinfo/wg-uma > > -- @commonaccord

1 0

No WG meeting on Oct 1 or Oct 8
by Eve Maler 06 Oct '15

06 Oct '15

Hi folks— A few people have indicated they need a little more time to work on UIG action items, and we don’t have a lot of other really urgent business until the Public Review period end gets closer. (And I have conflicts. :-) If those with AIs can please work on them in the meantime, and if everyone (particularly voting participants) can also please be sure to mark your calendars for the Oct 22 and Nov 5 meetings so that we can make quorum to discuss Public Review comments and approve changes for the Draft Recommendations, I think we’ll be fine not meeting for the next two weeks. Let’s keep up with our legal subgroup meetings, though. And let’s hold the next APAC sync, which is scheduled for Oct 15. Thanks! Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 1

Recommendation from leadership team re IETF I-D situation
by Eve Maler 05 Oct '15

05 Oct '15

Since our previous WG discussion on this was inconclusive, Thomas, Maciej, and I discussed the question of whether we should let our current IETF Internet-Drafts expire without update vs. revise them preparatory to our original Informational RFC submission plan. Our consensus was to let them expire. https://tools.ietf.org/html/draft-hardjono-oauth-resource-reg-06 (exp Oct 6) https://tools.ietf.org/html/draft-hardjono-oauth-umacore-13 (exp Oct 6) https://tools.ietf.org/html/draft-maler-oauth-umatrust-03 (exp Oct 7) Rationales: Contributions there hadn’t stimulated any feedback or activity coming from the IETF quarter, and there is benefit in having a single canonical version of the specs to refer to. We found diminishing appetite to approach other forums. We’re due to consider a revision of our charter anyway, so let’s look at aligning it with the new plan in our Oct 22 call (assuming quorum), unless anyone would like to make a case for keeping the current plan (or some other third option). If you have questions or concerns, please float them in this thread. Thanks, Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

3 5

Notes from UMA legal subgroup telecon 2015-10-02
by Eve Maler 03 Oct '15

03 Oct '15

Check on AI status: [DONE <https://github.com/KantaraInitiative/wg-uma/wiki/UMA-Legal:-Business-Models>] Business model wiki page [DONE <https://github.com/KantaraInitiative/wg-uma/wiki/UMA-Legal:-Examples-of-Ter…>] Collection of sources of contract terms for getting OAuth client credentials Jon: Thoughts on IoT liability tensions Determine roughly what our outputs should look like Develop a list of unknowns without which we can’t finish our work How to prioritize the rest of the work? Gather which unknowns? Who? Examine/analyze OAuth contract terms? Who? Examine/analyze existing Binding Obligations? Who? What are our key milestones in the final three months? Attending: Eve, Jon, Jeff, Adrian, Steve, Jim, Thomas, Scott, Dazza Steve Greenberg is a new UMAnitarian. He was in the technical game long ago, an LDAPer, an AOL employee, then into consent management (mostly recently at Privo doing delegated consent for parents — COPPA stuff). Jim notes that “A legal document - whether policy , consent or otherwise - is always "ours" in the sense that is belongs to and binds both parties. The problem is friction means that in practice it is more or less owned by one party. Goal should be to reduce and eliminate friction - which is to say to start a process of transparency.” So, in talking about Alice choosing "her own AS”, we should be aware that, while technically, she does choose, in practice some business models disempower her more over some others. Famously, most people don’t read the privacy policy, even though they’re bound by it. There are often clauses in a contract that are there because you’re afraid to take it out. (There are 1M lawyers in the US!) Real standards have the advantage of eliminating much of the friction and imbalance. This is where our work can come in. Jim advocates modularity here, in the model of open-source with forking and agile methods and iteration and so on. It’s how you can “get to something like yes” on exceedingly complex matters efficiently and quickly. Committees (people!) don’t help. An operating document that works today, for now, is what’s needed. This sounds like a “good enough for now” principle, with versioning to allow change later. In law, the "operative thing” would be, say, a privacy policy; that’s the “object” that has to be tracked and versioned. Jon speaks in favor of giving the parties on both sides "something to work with”, which speeds the process. It’s not just about machine readability. And it’s not even just about “empowering Alice”. Adrian brings up Bitcoin as an example of how to enable dynamicism in a “free love” way. Scott speaks in favor of modularity as a cause and an engine. The commodities market runs on it; so we could coax a market into being and stabilization. Business people who don’t care about code will find these examples resonating. Steve mentions Creative Commons as well. With lots of unknowns in this data market, let’s stabilize it. For a long time, Eve has talked about Alice’s disempowerment in terms of human-vs-company and client-vs-browser — and also “contract of adhesion”. But apparently the latter is too strong a statement in legal terms. It’s more like she’s just following the crowd and that’s a constraint and compulsion. We’re seeing that business model #2 starts to be one end of a continuum that ends in #3, if we can more fully empower Alice to “choose her AS” through contract and enable more dynamic business relationships through our work here. In notice and consent, there has always been a feeling of “take it or leave it”. Eve’s hope in the original Binding Obs work was to turn Alice’s enforceable service terms in using a website and sharing her PII with it into Bob’s enforceable service terms for accessing her stuff. Jim notes: Pragmatically, a good way to get the dynamic of codification going would be to list the kinds of documents that are currently used, find a couple of examples of each, do outlines for each of them, and begin to populate. Scott advocates leveraging selfish interest. RO-RqP: The use cases tend to be “delegation", “share", "give access to”, “purpose of use”, “meaningful use"… (Scott warns to be careful to distinguish “assignment of rights in the delegation of duties” / “assignment of rights and duties”). RS-AS: Jim: From perspective of the merchant, regulatory compliance is a concern. A modular approach to text can take much of the burden off of them. Because it can be shared and scrutinized in a general context instead of them having to wing it. This is where a lot of regulations seem to come in - healthcare, merchant, etc., where modularity could help - an IoT hardware vendor may insist on “owning” the data and where it goes (?) - maybe also just web apps, as in Ashley Madison (RTBF)? Example terms: http://my.commonaccord.org/index.php?action=source&file=D/Fridge/MyFridge_G… <http://my.commonaccord.org/index.php?action=source&file=D/Fridge/MyFridge_G…> Jon notes that connected cars are most difficult, but with wearables, there are questions about communications between devices and the (e.g.) “house fog” (a house cloud — this is a Cisco term <http://www.cisco.com/web/solutions/trends/iot/fog-computing.html> . Would the controls over it be UMA controls? Adrian has a great example <https://dl.dropboxusercontent.com/u/8909568/MMS%20May%207%20AG.pdf> of ICD data communications using the “house fog” model. Dazza observes that there’s a localization of control — there’s still a question of who owns and controls the systems, all the way up. Buying a disconnected fridge and taking it home means you can do whatever you want to it. But in Europe, there’s “moral rights” that still connect the creator of the thing to the thing — the shoemaker to the shoes, the painter to the painter (“preference for restraint on alienation <https://en.wikipedia.org/wiki/Restraint_on_alienation> or something like that?). With IoT, it’s thus like inviting hackers into one’s living room because of the net connection! RO-AS: What contract terms might be relevant here? Jim: Could we make a list of docs that we think Alice is confronted with in the course of a year or two of banging around in this field? If UMA is about the human being at the center, and we’re focusing on zones that are private (looking at Anglo-American law), and the body, home, and car are places that are particularly relevant for privacy, and there is real market demand for privacy… Scott: In the US, the Fourth Amendment protects one on one’s home. Bringing a sensor into the home is inviting an intruder into “information space”/cyberspace/Internet space, which is a new important kind of space alongside physical space. We don’t yet have rules for this; UMA enables having rules for that new space. He recommends treating this as privatized space: like putting a sign up that says “This is the private property of X”. Next steps: Everyone please contribute “mile-wide, inch-deep examples on contract terms examples across all three meta-use cases — at least one of each kind — for next week. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 4

Reminder: UMA legal subgroup telecon 2015-10-02
by Eve Maler 01 Oct '15

01 Oct '15

Hi folks — Would love to have folks representin’ on the call tomorrow! Can you please RSVP to me in private email (and/or respond to the calendar invitation if you haven’t already)? Tom, let me know if you’re still not getting list email. There are several messages that go out per week, so if you haven’t seen any, there’s still a bug… Thanks! Eve Fri Oct 2 8-9am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Check on AI status: [DONE <https://github.com/KantaraInitiative/wg-uma/wiki/UMA-Legal:-Business-Models>] Business model wiki page [DONE <https://github.com/KantaraInitiative/wg-uma/wiki/UMA-Legal:-Examples-of-Ter…>] Collection of sources of contract terms for getting OAuth client credentials Jon: Thoughts on IoT liability tensions Determine roughly what our outputs should look like Develop a list of unknowns without which we can’t finish our work How to prioritize the rest of the work? Gather which unknowns? Who? Examine/analyze OAuth contract terms? Who? Examine/analyze existing Binding Obligations? Who? What are our key milestones in the final three months? Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Use signed JWT as RPT?
by Mike Schwartz 01 Oct '15

01 Oct '15

UMA-tarians, One of Gluu's customers has proposed using a JWT as the RPT token signed by the AS to avoid the call to the introspection API (for better performance). It didn't seem like a horrible idea, or anything that would break the security. Any thoughts? Am I wrong--is there some inherent security advantage to calling the introspection API? - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO

3 2