July 2018 - WG-UMA - mailman.kantarainitiative.org

FYI, IEEE SA 7012 - Standard for Machine Readable Personal Privacy Terms
by Eve Maler 24 Aug '18

24 Aug '18

Hi WGs-- This past week at IIW a session was held (I wasn't able to attend the session itself) about an IEEE project to develop "machine readable personal privacy terms": https://standards.ieee.org/develop/project/7012.html "The purpose of the standard is to provide individuals with means to proffer their own terms respecting personal privacy, in ways that can be read, acknowledged and agreed to by machines operated by others in the networked world. In a more formal sense, the purpose of the standard is to enable individuals to operate as first parties in agreements with others--mostly companies--operating as second parties. Note that the purpose of this standard is not to address privacy policies, since these are one-sided and need no agreement. (Terms require agreement; privacy policies do not.)" This seems to have potential relevance for Consent Receipts, User Submitted Terms, UMA, and UMA Legal. Joyce Searls was the one announcing the session during agenda creation, so I managed to speak with her prior to the scheduled session, and she shared this link with me afterwards. She also said "Take a look at the write up and click through to register interest. We will be having our first formal meeting within a month or so." *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

7 9

Sorry for lack of agenda today — shall we meet?
by Eve Maler 26 Jul '18

26 Jul '18

I’ve been (and am still) on the road, but I do have time for the call. Apologies for my absent-mindedness. Do we have sufficient items to suggest that meeting today would be productive? Please send them in. I will make the decision an hour ahead and send a note here and on Skype. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 1

Article: "Why protecting privacy is a losing game today—and how to change the game"
by Thomas Hardjono 20 Jul '18

20 Jul '18

Dear UMAnitarians, You might find this article interesting: "Why protecting privacy is a losing game today—and how to change the game". https://www.brookings.edu/research/why-protecting-privacy-is-a-losing-game-… Best -- thomas --

5 6

W3C Workshop on Permissions and User Consent Sep 18-19 in San Diego
by Eve Maler 17 Jul '18

17 Jul '18

https://www.w3.org/Privacy/permissions-ws-2018/cfp.html Note that there's also Consumer Identity World Sep 19-21 in Seattle. (I'll be speaking there in the Kantara workshop session.) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-07-12
by Eve Maler 12 Jul '18

12 Jul '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-07-12 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-06-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-14>: Deferred. Vermont's new law David worked on Vermont's new S.269 <https://legislature.vermont.gov/assets/Documents/2018/Docs/ACTS/ACT205/ACT2…> ensconcing Personal Information Protection Companies (PIPC) (see the news <http://www.gravelshea.com/wp-content/uploads/2018/06/Blockchain-Terrain.pdf>). The law sets up a basic framework for PIPCs, but there is a lot of room for the specifics. Tim had a role in the work as well. Sec. 5 in the law calls for a FinTech Summit to be held, and the Department of Financial Regulation to take further steps. There could be appetite for learning how UMA can provide value in separating "personal information" services from "protection" services. Thomas served as a moderator at the DC blockchain caucus. The blockchain startup CEOs mentioned Vermont as leading in the area of "blockchain sandboxes", but being blocked at the federal level. Propy is a new company in Vermont doing <https://blog.propy.com/propy-announces-first-us-pilot-with-vermont-23ec0b2d…> land registry/real estate recording. Because of the US blockages, the first POC was in Ukraine. What about UMA with and/or vs. DIDs? Eve's recent answer when asked: "I know of a couple of projects that combine them, and I consider them complementary. UMA has long had a design principle about being “ID-agnostic” (see the Charter <https://kantarainitiative.org/confluence/display/uma/Charter>) and it seems to work. Also, the actual consent, permissioning, and access control mechanisms built into SSI-type systems, as far as I can see, aren’t directly related to their blockchain tech but are part of the rest of their app stack. So they [the consent/permissioning/access control mechanism] could be proprietary, OAuth/UMA-based, etc." More specifically, UMA has several places where identifier/claim sources come into play: How a RO identifies themselves to the RS, how a RO identifies themselves to the AS, how the AS gathers claims from the RqP interactively, and how the client conveys a claim token to the AS token endpoint. Mike notes that a DID is a reference to what UMA calls a claim token and, we think, doesn't specify a format. The BSC DG report <https://kantarainitiative.org/file-downloads/report-from-the-blockchain-and…> has a figure illustrating the role of blockchain tech (potentially necessary, but always insufficient) in an app stack. Leadership team elections The current leadership team roster is here <https://kantarainitiative.org/confluence/display/uma/Leadership+Team>. *MOTION:* Sal moves: Eve to serve as chair for another annual term and Maciej to serve as vice-chair for another annual term. APPROVED by unanimous consent. New issue 361 Next time we open up the specs, we'll take a look at this. Discuss/compare financial and health "multi-portal problem" use cases - Discuss/compare HEART <http://openid.net/wg/heart/> use case Alice Shares Clinical Records With Her Spouse <http://openid.net/wordpress-content/uploads/2018/07/AliceSharesClinicalReco…> and Origo use case (see their architecture <https://www.origo.com/news/PensionsDashboardArchitecture.aspx> description, adoption <https://www.origo.com/news/Bringing_Pension_Industry_On_Board_Pensions_Dash…> recommendations, and performance testing <https://www.origo.com/news/Pensions_Dashboard_Scalability_Release.aspx> news) for cross-sector implications of the "multi-portal problem" - May relate to issues 53 <https://github.com/KantaraInitiative/wg-uma/issues/53> (Assess interest in making AM a formal client of APIs for policy servers, interaction services, etc.) and 106 <https://github.com/KantaraInitiative/wg-uma/issues/106> (Have an API to let an RS register the user’s sharing preferences/policies directly) Maybe new UMA infrastructure (Eve had been imagining that you need a formal policy API and a "consent API access token" or CAT!) isn't strictly necessary, at least for now. Looking at the Origo solution (see the two-part UK Pensions Dashboard scenario in the "Legal role definitions <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…>" slides), its Pensions Dashboard service is the unique client app that then presents a policy-setting service to the RO. It needs the two-step approach that Origo uses, but it works for then sharing with RqPs who aren't equal to Alice, and for centralized policy setting with a client where the business climate (as in US healthcare today) wouldn't be friendly to each AS not working with competitor RS's running policy interfaces. This solution may be a common design pattern. AI: Eve: Intro Nancy and David in email to pursue the topic further prior to the next call (which is *July 26*). Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Sal 2. Maciej 3. Eve 4. Mike Non-voting participants: - Thomas - Nancy - Bjorn - David Thelander - lawyer - licensed in Vermont, SEC background, Gravel & Shea, blockchain and identity trust companies Regrets: - Domenico *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-07-12
by Eve Maler 11 Jul '18

11 Jul '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-07-12 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes: Approve minutes of UMA telecon 2018-06-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-14> - Leadership team elections: chair, vice-chair for annual term - Note: New issue 361 <https://github.com/KantaraInitiative/wg-uma/issues/361>: OAuth AS metadata spec is final (no action now) - Discuss/compare HEART <http://openid.net/wg/heart/> use case Alice Shares Clinical Records With Her Spouse <http://openid.net/wordpress-content/uploads/2018/07/AliceSharesClinicalReco…> and Origo use case for cross-sector implications of the "multi-portal problem" - May relate to issues 53 <https://github.com/KantaraInitiative/wg-uma/issues/53> (Assess interest in making AM a formal client of APIs for policy servers, interaction services, etc.) and 106 <https://github.com/KantaraInitiative/wg-uma/issues/106> (Have an API to let an RS register the user’s sharing preferences/policies directly) - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Indian Consent Tech Framework
by Adrian Gropper 08 Jul '18

08 Jul '18

See attached. I'm involved in various (health) data infrastructure policy groups for India. I consistently try to steer them in the direction of UMA. This document is referenced in relation to India Stack and National Health Stack for India. There's a lot going on and it seems to be moving quite quickly. I'm looking for allies and help with comments as might come up. -- Adrian

1 0