- WG-UMA - mailman.kantarainitiative.org

Re: [WG-UMA] [WG-InfoSharing] Article 29 Working Party Releases Opinion on the R...
by John Wunderlich 07 Aug '16

07 Aug '16

James; I’m unaware of such a group collaboration with respect to the GDPR, but would also love to find out about it if it exists. I’ve had to read the GDPR end to end a number of times recently for an engagement I had. It will be interesting to see how what you call, I think correctly, “a powerful point of view”, interacts with the also powerful forces of commercial inertia that have build the personal data ecosystem based on a de facto treatment of personal data as property. My experiences with large enterprises suggests that we are at the confluence of a number of development curves: 1. *Personal Data Economy*: This is how the Internet was monetized and is fully mature. It is predicated on contracts of adhesion or terms of use that enable one way doors for the collection of personal information by entities that then get to use that data as they see fit, with marginal constraints that appear occasionally if a particularly heinous security or privacy incident reaches a regulator or the press. This is in many ways a mature market. 2. *Big Data*: Moore’s law has put affordable big data on the table. Despite the hype in the media and with VC’s my suspicion is that actual useful big data installations are still at the Early Adopters stage. Much of the predicted profit from Big Data comes from the personal data economy and assumes unfettered access to data lakes of personal information . This is where ‘innovation’ is happening. And it’s not good for the GDPR or our personal data autonomy generally. Notwithstanding nattering about these innovations, large organizations with a dependency on the status quo will push back hard against anything that might require a change in business model or business processes. Similarly, startups seeking VC money tend to articulate their MVP in terms of existing schema for profit and monetization. A couple of cliché’s come to mind involving rocks and hard places or immovable objects and irresistible forces. This is why the Kantara Incubator <https://kantarainitiative.org/confluence/display/ccicada/Home> is so necessary and exciting. It presents researchers and startups with an opportunity to innovate against the mature personal data economy itself, rather than try and come up with news ways of monetization (which is essentially all that the current big data initiatives appear to be). I don’t know what the successor to the Personal Data Economy will be. It may be as simple as the Personalized Data Economy, where the locus of control shifts from the data controller to the subject. But it seems clear that the GDPR and the Personal Data Economy as it is currently constituted are mutually incompatible. - Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca On 7 August 2016 at 11:51, James Hazard <james.g.hazard(a)gmail.com> wrote: > Yes, nice summary. The official introduction to the GDPR - the > legislative whereas-es - is as good a work of digesting a complex legal > subject matter as I have ever seen. In its _173_ sections of introduction, > it touches on a great deal of the landscape - interactions of privacy, > security, national differences, technology, judicial systems, legislation, > etc. Yet still present a powerful point of view and specific positions. > > Is anyone aware of a place where this - the GDPR as a whole or the > introduction - is collaboratively commented? I would love to know of it. > > http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/? > uri=CELEX:32016R0679&from=EN > > > On Sun, Aug 7, 2016 at 6:47 AM, John Wunderlich <john(a)wunderlich.ca> > wrote: > >> Nice summary >> >> http://www.dataprotectionreport.com/2016/08/article-29- >> working-party-releases-opinion-on-the-revision-of-the-eprivacy-directive/ >> >> >> >> John Wunderlich, >> >> Sent frum a mobile device, >> Pleez 4give speling erurz >> >> "...a world of near-total surveillance and endless record-keeping is >> likely to be one with less liberty, less experimentation, and certainly far >> less joy..." A. Michael Froomkin >> >> >> >> This email and any files transmitted with it are confidential and >> intended solely for the use of the individual or entity to whom they are >> addressed. If you have received this email in error please notify the >> system manager. This message contains confidential information and is >> intended only for the individual named. If you are not the named addressee >> you should not disseminate, distribute or copy this e-mail. Please notify >> the sender immediately by e-mail if you have received this e-mail by >> mistake and delete this e-mail from your system. If you are not the >> intended recipient you are notified that disclosing, copying, distributing >> or taking any action in reliance on the contents of this information is >> strictly prohibited. >> >> _______________________________________________ >> WG-InfoSharing mailing list >> WG-InfoSharing(a)kantarainitiative.org >> http://kantarainitiative.org/mailman/listinfo/wg-infosharing >> >> > > > -- > @commonaccord > -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Creative names for consent in UMA [Legal]
by Adrian Gropper 06 Aug '16

06 Aug '16

Today's legal call was about the contract between the Grantor and the AS - or is it the ASO? As I understand it, we're looking for language to describe the relationship between the grantor / resource owner and her agent that will be operating an authorization service on her behalf. The section on Agents starts at page 67: http://docplayer.net/4194796-Restatement-of-the-law-agency-restatement-thir… The description of fiduciary duty seems to be quite clear. Page 72 deals with Principal's Consent. The key paragraphs are (my underline): - (1)(a)(ii) (ii) discloses all material facts that the agent knows, has reason to know, or should know would reasonably affect the principal's judgment unless the principal has manifested that such facts are already known by the principal *or that the principal does not wish to know them* - (1)(b) (b) the principal's consent concerns either a specific act or transaction, or acts or transactions of *a spe**cified type that could reasonably be expected to occur* in the ordinary course of the agency relationship. When Alice is informed about a particular transaction by the agent (in UMA this means that Alice is alerted to the specific RqP, Client, and Scopes) the situation is clear because Alice is more or less in the authorization loop. I would not use consent to describe this kind of transparency but IANAL. Under what circumstances can the Agent be less transparent? Regardless of our creativity in adding modifiers like "dynamic" to consent, the key points are underlined by me as - A positive statement by Alice that she doesn't want to be notified, or - A "specified type that could reasonably be expected to occur". I propose that the only way to get closure on this topic is by focusing on these two issues when Alice is signing a contract with an AS as a separate entity. The burden is on the ASO to adequately describe to Alice the specifications of the transactions that she will not be notified about and that are reasonably expected to occur. Alice would then use these descriptions in court in case of dispute. Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

2 3

Notes from UMA legal telecon 2016-08-05
by Eve Maler 05 Aug '16

05 Aug '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-08-05 - Review User-Managed Access (UMA) in Contractual and Regulatory Contexts <https://docs.google.com/a/wunderlich.ca/document/d/1HGM5-PoJFMnepyrTX91hqHK…> - Nailing down the right 1-2 paragraph scenario for use throughout the document (send your alternatives before the meeting) Attending: Eve, Kathleen, Andrew H, Adrian, Mary, Jim, John *NOTE:* No meeting next week! Regarding finding the right scenario: Smart home scenarios are really just as important due to sensitivity as health scenarios. In health research, it looks like the first BSC use case is going to get more complex still because real-life scenarios are getting blocked due to patients' reluctance to consent without a way to be notified of additional researchers' requests to access. Jim notes that "broad" consent is the key problem – anticipating future needs. And speaking of this, Adrian dislikes "informed" consent, because people don't know what's going to be done with it later. Transparency in being kept aware of status and where else the data is traveling is a key part of resource owner empowerment. Our discussion this time is ranging all over, but it all seems related to our hoped-for Regulatory section. Maybe we need a discussion in the Regulatory section about what "consent" maps to in UMA's "authorization" concept. There is a notion of authorization as a thing that can be dynamic – an RO can grant authorization and later revoke it (by an interaction with the AS that is actually outside the protocol but in scope for our model text), at a grain that is finer than Ts & Cs, and empowered by that grain, by the option to "Share" at will, and by the option to "un-share" any portion of the resource at will. John likes the phrase "Dynamic Consent"... It may be taken already. See this Nature article <http://www.nature.com/ejhg/journal/v23/n2/full/ejhg201471a.html>. Hazard@All: could have an obligation on the data user to destroy. Like my passport number for a hotel stay. Hazard@All: but once the other guy has it, we need to rely on some other method to have them delete it. Hazard@All: either contract or escrow Hazard@All: that is a matter of legal verbiage, I think Hazard@All: the lawyers phrase it however seems to work Hazard@All: and the vocabulary will change based on dozens of factors, including the common vocabulary of the business sector, jurisdiction and language Hazard@All: notice can be specified however you want - right? Hazard@All: you can use my stuff but you agree to text me whenever you do. Would we have to deal with privacy/data protection regulations as property-based vs. rights-based in our model text? We may very well, but it needs more discussion. Could Jeffrey apply his model? *AI:* Eve: Ask if Jeffrey would be willing to adapt his Information Governance school assignment into a small scenario for the primer, adding Alice to it, as an alternative scenario for consideration. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

FYI: Paper on cloud personal data privacy
by John Wunderlich 05 Aug '16

05 Aug '16

https://www.academia.edu/27238178/Approaches_on_Personal_Data_Privacy_Prese… Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Agenda for UMA legal telecon 2016-08-05
by Eve Maler 04 Aug '16

04 Aug '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 / US +1-805-309-2350 / international lines <https://www.turbobridge.com/join.html> / web interface <https://panel.turbobridge.com/webcall/>, code 178-2540# - Screen sharing: http://join.me/findthomas – NOTE: do not use the join.me dial-in line - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-08-05 - Review User-Managed Access (UMA) in Contractual and Regulatory Contexts <https://docs.google.com/a/wunderlich.ca/document/d/1HGM5-PoJFMnepyrTX91hqHK…> - Nailing down the right 1-2 paragraph scenario for use throughout the document (send your alternatives before the meeting) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Apple is trying to patent UMA
by Adrian Gropper 03 Aug '16

03 Aug '16

We must be on the right track. http://www.patentlyapple.com/patently-apple/2016/07/apples-patent-pending-i… Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

2 1

Sigh, I did not just mean to delete Thursday's call from our calendar
by Eve Maler 03 Aug '16

03 Aug '16

I'm putting it back right now. We're still on. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2016-08-04
by Eve Maler 03 Aug '16

03 Aug '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-08-04 Date and Time - *Thursdays,* 9-10am PT - Skype: +99051000000481 / US +1-805-309-2350 / international lines <https://www.turbobridge.com/join.html> / web calling interface <https://panel.turbobridge.com/webcall/> / code 1782540 - Screen sharing: http://join.me/findthomas - NOTE: do not use the join.me dial-in line - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2016-06-30 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-30> , 2016-07-07 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-07-07> , 2016-07-14 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-07-14> - Logistics items - Telecon interruptions - I-D expirations - For reference: MPD sequence diagram <http://www.websequencediagrams.com/files/render?link=2DdzslbnVj3ShhlrLVV-> and generic low-level sequence diagram <http://www.websequencediagrams.com/files/render?link=V0tZE2kWrO0l-tGlZX1a> - Client awareness of scopes and set math <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-02> - How to give resource set ID context to standardized resource set and scope semantics profile idea <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-07-28> ? - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Transferring standardized resource set and scope semantics out of band: digging deeper
by Eve Maler 01 Aug '16

01 Aug '16

Last Thursday we got this far in our understanding about transferring standardized resource set and scope semantics (say, as captured in the FHIR API or some other large, complex API implemented by multiple independent service operators) out of band of the UMA RSR process: http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-07-28 The AS would declare that it's using the protection API extensibility profile, meaning that it's prepare to go outside the normal AS-RS communication route for some part of its interaction with RS's. The community around the relevant API would define an extension profile. (We didn't talk about this, but such an extension profile would define an URI as an identifier, and this URI would be referenced in the AS config data/discovery document, advertising its compatibility with that profile.) The profile would, we believe, possibly involve explicit registration of a "bootstrap" resource that signals implicit registration of other resources that have standardized "type" fields. It occurs to me that what's incomplete about this scheme (at a minimum -- there may be other things missing) is that, in explicit RSR, we register "instances" and not "types" of resource sets, and the RS gets back from the AS a specific resource set ID that has been dynamically created for it, and can't *tell* the AS what resource set ID it wants. E.g., let's say that the RS registers a "bootstrap resource set" of "FHIR:EHR" type with the AS on Alice's behalf (and gets back a resource set ID of "foo"), which the HEART-UMA-FHIR profile defines as signaling that a whole bunch of other "sub-resource sets" of other specific types should be automatically registered too, like one with the "FHIR:medicationlist" type and one with the "FHIR:allergylist" type and whatever. What, exactly, are their resource set IDs in the Alice context? Since we had wanted to create these implicitly and not with an API call, how would the RS be informed of what these are? Or do we have to actually invent new bulk ways of doing this in-band? (In a draft version of the RSR API, we used PUT instead of POST, which enabled the RS to dictate its own resource set IDs, but gave that up for very good reasons.) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 2

Gaps in Oversight of Privacy and Security of mHealth Technologies and Health Social Media
by John Wunderlich 30 Jul '16

30 Jul '16

The predecessor and marketing problem before UMA or CISWG is how to get entities that aren't required to give users control over their own data to do so. https://www.healthit.gov/sites/default/files/non-covered_entities_report_ju… Thanks, John 4giv spellin errurz from mobile devize -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 2