- WG-UMA - mailman.kantarainitiative.org

Notes from UMA Legal telecon 2018-01-19
by Eve Maler 19 Jan '18

19 Jan '18

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2018-01-19 Attending: Eve, Colin, Tim, Adrian, Mark, Kathleen Agenda: - Final edits to the business model doc draft 7c, taking into consideration comments collected during UMA telecon 2018-01-18 - Get the draft ready to send to WG members for review in PDF form so we can do an e-ballot for draft WG report publication *Regarding the Vermont legislation:* Though the overt focus is blockchain, Colin has some thoughts about the notion of a "personal identity trust company". Can we simply have a conversation with the legislators? Yes! Tim reads the bill as being about identity brokering. Which others could also provide input? Perhaps those with an eye on the legal landscape as well as identity and privacy. (John W?) The bill authors have expertise in banking law. Adrian could talk to them as well – turns out he's already aware of the effort. We don't want to necessarily derail their "blockchain" focus, but we want to introduce them to our notion of the ASO as an agent and the power of that. Colin can help with those experienced on the brokering side, and mentions some comparative country ID efforts. Adrian mentions India's identity system Aadhar and their efforts towards greater privacy; he's involved on the health records side. *AI:* Tim: Make introductions as appropriate between the Vermont legislators and the UMAnitarians. *Business model paper:* Elevator pitch in doc: *A Proposed Licensing Model for User-Managed Access* Can we describe our audience much more directly? Old: *This paper is intended for audiences who are business-knowledgeable and experienced with legal devices.* New: *This paper is intended for professionals in the areas of law, privacy, risk, compliance, security policy, and business policy, particularly those responsible for building and running UMA-enabled services.* Latest subtitle/elevator pitch: *How the UMA access sharing protocol together with a licensing model for personal digital assets enables user-centric control in the network-based information society* Mike's, with additions: *How UMA enables an individual to control access to their personal digital assets in the information society <<when UMA-enabled services are mapped to a licensing model>>* Playing around/discussion: *UMA protocol (associate it with "privacy" and "privacy instruments"?) and licensing model * Further work: *How licensing enables personal digital asset access control for individuals using services enabled by the UMA protocol, heightening privacy protection <<and compliance?>>* Arrgh, so close! Tim and Eve will try and wrap up all the remaining comments in the doc by Monday and get the e-ballot out. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Legal call tomorrow
by Eve Maler 18 Jan '18

18 Jan '18

Agenda: - Final edits to the business model doc draft 7c, taking into consideration comments collected during UMA telecon 2018-01-18 - Get the draft ready to send to WG members for review in PDF form so we can do an e-ballot for draft WG report publication Note that there is no Legal call next week. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-01-18
by Eve Maler 18 Jan '18

18 Jan '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-01-18 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-01-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-01-04>: APPROVED by unanimous consent. Update on logo Eve reported out on Kantara's feedback and the decision on the "blue circle, green 2" version. We should prepare different sizes and an SVG version. *AI:* Domenico: Prepare the different logo versions needed. *AI:* Eve: Put the different logo versions on the wiki. Meeting schedule update - No meetings next week On the Thursday, if you're interested, check out the livestream of Data Privacy Day <https://staysafeonline.org/data-privacy-day/>. Update on auxiliary materials - FAQ and Wikipedia entries need attention You can get to the FAQ by going to http://tinyurl.com/umafaq. Eve has a personal action item to add FAQ links to known and forthcoming known books that discuss UMA. Here is Mike's: Deploying Identity and Access Management with Free Open Source Software <https://www.apress.com/us/book/9781484226001>. Mike/Gluu offers to do some Wikipedia entry editing. BTW, his book is scheduled to come out July 1st! The UMA2 chapter should be done in a couple of weeks. Domenico is willing to continue doing the Italian entry translation once Mike/Gluu has done a revision to the English one. Brief report on OAuth WG interim meetings Eve attended a meeting on a "distributed OAuth <https://tools.ietf.org/html/draft-hardt-oauth-distributed-00>" draft, and Eve along with Justin attended a meeting on a "mutual OAuth" draft (now updated <https://tools.ietf.org/html/draft-hardt-oauth-mutual-02>). She shared some UMA background related to the as_loc discovery method, federated authorization, and some of the lessons UMAnitarians have learned as a result, on the theory that they may be relevant to the "distributed OAuth" topic. UMA Legal update and draft Report discussion/WG vote We need to do a bit more editing and share a PDF with WG members (maybe just individually at this point) after tomorrow's editing session. Then the WG would be ready for a vote. They need more time for a proper reading and review. 2018 charter and roadmap discussion - Potential items: - Joint consent receipt work - Working on issues with the "extension" label - Legal framework/business model - What else? We do need to refresh our charter, and some things are coming up as extension ideas among those talking to/working with customers on UMA stuff that we should put on the roadmap list! HEART has two UMA-related profiles; some stuff in there is a bit more "extension-ish" than "profile-ish". There is also a Pensions Dashboard profile (not extension). Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Andi 4. Eve 5. Mike Non-voting participants: - James - Tim *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-01-18
by Eve Maler 17 Jan '18

17 Jan '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-01-18 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Update on logo - Meeting schedule update - No meetings next week - Update on auxiliary materials - FAQ and Wikipedia entries need attention - Brief report on OAuth WG interim meetings - Meeting schedule - No meetings next week - UMA Legal update and *draft Report discussion/WG vote* - *2018 charter and roadmap discussion* - Potential items: - Joint consent receipt work - Working on issues with the "extension" label - Legal framework/business model - What else? - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA Legal telecon 2018-01-12 (reminder: no Legal call next week)
by Eve Maler 12 Jan '18

12 Jan '18

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2018-01-12 Attending: Eve, Colin, Tim We worked through paper 7c live on the call. Eve finished her action item to add a scope/audience paragraph live, too. There are Code of Conduct materials extant, both external to Kantara and within Kantara (including pointing to those other sources), which can be built on to bootstrap an UMA-related "company code of conduct" assessment offering (and even a similar OAuth-related substrate). Some discussion went on about this in the past week. The current Business Model paper, and probably a series of other short papers in some "call tree" order (paper A cross-refers to paper B etc.), would be formally referred to by some set of tools. If these were technical specs, those linkages would be obvious – so let's be sure to make them obvious. Paper draft 7c is getting ready to be a "beta" version for external review. The WG should vote it upward as a Draft Report if so, and we'd have to see if the LC then needs to review it, but then it could potentially be put under the Reports & Recommendations page as a PDF download. The legislature in Vermont is developing a law that has UMA-ish elements. They have the concept of an "autonomous agent", which sounds like an ASO! Tim mentioned that UMA has solved this issue. They may need someone to testify on such matters. *AI:* Tim and Eve: Work through the paper on an ad hoc basis early next week. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

No WG call this Thursday / still a Legal call on Friday
by Eve Maler 10 Jan '18

10 Jan '18

Let's celebrate reaching Recommendation status by taking Thursday off. :-) In the meantime, please be thinking about 2018 roadmap items, and please review the (updated) Release Notes <https://kantarainitiative.org/confluence/display/uma/UMA+Release+Notes>, (updated) UIG <https://kantarainitiative.org/confluence/display/uma/UMA+Implementer's+Guide>, (not-updated but badly in need of it) FAQ <https://kantarainitiative.org/confluence/display/uma/UMA+FAQ>, (not-updated but badly in need of it) Wikipedia entry/ies <https://en.wikipedia.org/wiki/User-Managed_Access>, PbD paper <https://kantarainitiative.org/confluence/display/uma/Privacy+by+Design+Impl…>, and other collateral. I will be spending time this week updating IANA with our registration request info and new links, and sorting out other necessary stuff. Tim will have a Draft 7c of the Business Model document ready for us to peruse on Friday's Legal call. We *are meeting* next week (Jan 18-19). We are *not meeting* the following week (Jan 25-26) because I've got some Data Privacy Day obligations. (By the way, if you're in the Bay Area, I'm speaking on "GDPR, PSD2, CIAM, and the Role of User-Managed Access 2.0" at the Silicon Valley IAM Meetup <https://www.meetup.com/Silicon-Valley-IAM-User-Group/events/246333142/> on January 24, so please join me!) *Congratulations and thanks again to all the UMAnitarians on reaching the UMA2 milestone!* *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Why the PAT? Here's why
by Eve Maler 09 Jan '18

09 Jan '18

I couldn't take it anymore :) and put the revised article into the UIG: https://kantarainitiative.org/confluence/display/uma/UMA+Implementer's+Guide#UMAImplementer'sGuide-why-the-patMotivationsfortheDesignofthePAT Thanks to the commenters so far! Happy to take other suggestions/improvements. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Recommendations published! / New UIG security considerations section
by Eve Maler 09 Jan '18

09 Jan '18

Hey folks-- Please check out the following links -- and thanks for all your hard work!! https://twitter.com/UMAWG/status/950803880727609344 https://kantarainitiative.org/reports-recommendations/ ==== I added a draft section to the UIG to describe the security considerations we've been discussing. This is based on our conclusions of telecon 2018-01-04. Please let me know what you think. We can always revise as needed. https://kantarainitiative.org/confluence/display/uma/UMA+Implementer%27s+Gu…'sGuide-front-channel-securitySecurityConsiderationsRegardingInteractiveClaimsGatheringFlows *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Contributions Program launches annual call for innovative research and knowledge translation proposals - Office of the Privacy Commissioner of Canada
by John Wunderlich 08 Jan '18

08 Jan '18

You’ll know if this applies to you: I think that this has already been circulated, but just in case. There are 10 days left to apply to the contributions program for the privacy commissioner of Canada. Applicants are academics and not-for-profits and trade associations, so if you want funding for research or a translational program and you have a qualifying footprint in Canada, you may want to get busy: https://www.priv.gc.ca/en/opc-news/news-and-announcements/2017/an_171115_cp/ John Wunderlich, BA, MBA @PrivacyCDN <https://twitter.com/PrivacyCDN> Privacy Tools: Kantara Initiative <https://kantarainitiative.org/>: Consent Receipt Specification <https://kantarainitiative.org/confluence/display/infosharing/Consent+Receip…> JLINC Labs <https://www.jlinclabs.com/>: Data Provenance Solutions <https://www.jlinclabs.com/solutions/> PGP Signature: EA86 067A 73F9 ED6D E679 F040 E0BB EB36 A711 D416 -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Updated UMA PbD paper
by Eve Maler 07 Jan '18

07 Jan '18

I wanted to brush up the PbD paper in preparation for our publication of the UMA2 Recommendations. It at least enables the updating of the year of publication in the specs. :) It also helps us in our Legal effort... https://kantarainitiative.org/confluence/display/uma/Privacy+by+Design+Impl… (also available at http://tinyurl.com/umapbd ) Please let me know if you have any comments. (Other than adding the last section, I didn't really change it dramatically.) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0