April 2018 - WG-UMA - mailman.kantarainitiative.org

FYI, IEEE SA 7012 - Standard for Machine Readable Personal Privacy Terms
by Eve Maler 23 Aug '18

23 Aug '18

Hi WGs-- This past week at IIW a session was held (I wasn't able to attend the session itself) about an IEEE project to develop "machine readable personal privacy terms": https://standards.ieee.org/develop/project/7012.html "The purpose of the standard is to provide individuals with means to proffer their own terms respecting personal privacy, in ways that can be read, acknowledged and agreed to by machines operated by others in the networked world. In a more formal sense, the purpose of the standard is to enable individuals to operate as first parties in agreements with others--mostly companies--operating as second parties. Note that the purpose of this standard is not to address privacy policies, since these are one-sided and need no agreement. (Terms require agreement; privacy policies do not.)" This seems to have potential relevance for Consent Receipts, User Submitted Terms, UMA, and UMA Legal. Joyce Searls was the one announcing the session during agenda creation, so I managed to speak with her prior to the scheduled session, and she shared this link with me afterwards. She also said "Take a look at the write up and click through to register interest. We will be having our first formal meeting within a month or so." *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

7 9

Upcoming WG meeting schedule
by Eve Maler 13 Apr '18

13 Apr '18

Because of conferences and vacation, I've deleted some WG meetings from the April/May calendar. So our schedule currently looks like this (here's the calendar <https://kantarainitiative.org/confluence/display/uma/Calendar>): - Thu Apr 19: no meeting - Thu Apr 26: no meeting - Thu May 3: *meeting <-- note, we have a break coming up* - Thu May 10: *meeting* - Thu May 17: no meeting - Thu May 24: no meeting - Thu May 31: *meeting* Our current main focus is sanding off the edges of the business model and collecting use cases using it; I also expect some extension proposals to come in. I'd like to assemble a catalogue of use cases and figure out the right way to publish it by the end of May. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-04-12
by Eve Maler 12 Apr '18

12 Apr '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-04-12 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-03-01, UMA telecon <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01> 2018-03-29 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-29>: Deferred. IIW report It had a big turnout, ~260 registered and ~240 at the peak of attendance. A blockchain 101 was offered and not needed, so that was different from a couple of years ago. There was somewhat more focus from that perspective. Lots and lots of blockchain identity people attended. Mike's blog post after the fact on "SSO vs. SSI" <https://www.gluu.org/blog/sso-v-ssi/> (on a subject on which he also convened a session) reflected on some of the hot topics that got discussed on Twitter afterwards. (The diagrams in this tweet are also good.) Mike is plumbing (and Adrian has done in HIE of One) some use cases around pushed claim tokens that are in the form of decentralized IDs (DIDs). The moment that anyone is using cloud Agents, we have privacy problems back again that SSI is supposed to solve. Shame that conversations these deep didn't happen there. Justin held a session called "What do you hate about OAuth?" A similar session perhaps could usefully could have been held! [image: (smile)] A lot of the work in security is preventing a MITM, which is where TLS comes in. In any case, this WG can be complementary in many ways with such technology, and doesn't have to have any kind of official stance on SSI's architecture or marketing. Legal formal model Eve did a session at IIW on the draft model <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…>, which is now being revised. The formal business model is designed to enable: - The auditing of technical artifacts (such as tokens) in a privacy-sensitive way during a run of the protocol to be able to prove the claimed consent/permission/delegation/licensing happened - How the artifacts can link out to the relevant legal devices (contracts and licenses) - Determining patterns of which artifacts need to be dissolved (e.g., tokens to revoke) and then remade (issued) to serve various complex business use cases Cigdem has a use case where you have a flood network of devices. A household has these devices deployed. Data generated by the devices may involve personal data. Predictions made from this data might also involve personal data, but where it's derived or inferred, it's not "owned" by the data subject but rather an enterprise admin due to the way GDPR works (so this would be a Legal Person as Resource Rights Administrator – our new candidate name – and thus the resource owner). Does derived data include algorithms performed over data? Mark believes so. In the case of OPAL (Thomas's Open Algorithms work) and where the ro uses UMA to ask specifically for an algorithm to be performed over data she does own (so the rs has the algorithm and the c has the original data and retains rights in the data as it is transformed), we'd want the relevant legal devices to ensure that the RSO retains rights in the algorithm IP (OPAL talks about making these algorithms open source/openly inspectable), and the DS retains rights in their data and the resulting transformed data (even though GDPR seems not to require this). There's work going on to see if cancer patients could be paid every time their data is used for research. The Revised Uniform Fiduciary Access to Digital Assets (RUFADA <http://www.uniformlaws.org/shared/docs/Fiduciary%20Access%20to%20Digital%20…>) Act defines requirements for what we think of as "digital death"; it mandates an "online tool" (Authorization Server/Operator?) that enables the ability for a "user" (Data Subject?) to choose a "designated recipient" (Resource Rights Administrator?) for administering access to their digital assets held by a "custodian" (Resource Server Operator?) when they die; that recipient might (RRA again?) or might not (Requesting Party?) be the same as their "personal representative" (or executor or whatever). Tim is writing up the use case and Eve will put it into visual terms. All are invited to submit business use cases that we can publish as a catalogue. Mark mentioned that he's spoken to the FB privacy team about the digital death challenge; he'll make intros with Eve. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Eve 3. Mike 4. Cigdem Non-voting participants: - Justin - Colin - Scott - Mark - George - Bjorn - Thomas Regrets: - Tim - Andi *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Agenda for UMA telecon 2018-04-12
by Eve Maler 10 Apr '18

10 Apr '18

Lots happened at IIW 26, so we'll be reviewing that and deepening the formal model work. Let me know if you want to bring up extensions or other items as well. https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-04-12 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes - Approve minutes of UMA telecon 2018-03-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01>, UMA telecon 2018-03-29 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-29> - IIW report - Legal formal model - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0