- WG-UMA - mailman.kantarainitiative.org

Agenda for UMA telecon 2016-08-18
by Eve Maler 17 Aug '16

17 Aug '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-08-18 Date and Time - *Thursdays,* 9-10am PT - Skype: +99051000000481 / US +1-805-309-2350 / international lines <https://www.turbobridge.com/join.html> / web calling interface <https://panel.turbobridge.com/webcall/> / code 1782540 - Screen sharing: http://join.me/findthomas - NOTE: do not use the join.me dial-in line - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2016-06-30 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-30> , 2016-07-07 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-07-07> , 2016-07-14 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-07-14> - *N.B.:* No meeting next week - For reference: MPD sequence diagram <http://www.websequencediagrams.com/files/render?link=2DdzslbnVj3ShhlrLVV-> and generic low-level sequence diagram <http://www.websequencediagrams.com/files/render?link=V0tZE2kWrO0l-tGlZX1a> - Review new editors' draft of Core spec (forthcoming on Wednesday) - Client awareness of scopes and set math <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-02> if time - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

FYI
by John Wunderlich 10 Aug '16

10 Aug '16

Just posted this on a privacy list in Canada, but thought you might be interested: <clip> Last week the headline was: "Microsoft shops crowd sentiment analysis engine to Republic and Democratic National Conventions <http://mspoweruser.com/microsoft-shops-crowd-sentiment-analysis-engine-to-r…>" where the lead line was about Microsoft monetizing their research. Today the headline is: "Romanian spies want to spot faces in a crowd - illegally, say human rights groups <http://www.zdnet.com/article/romanian-spies-want-to-spot-faces-in-a-crowd-i…>" In their defence, the intelligence agency says that "The system does not collect new data. It only analyses existing data, based on algorithms." OK then. That makes it all right. I can't think of a better demonstration of the necessity for transparency and public oversight in the development and deployment of technologies that collect, use or disclose information about individuals. If the most profitable markets are political parties and intelligence agencies who want to collect the information for good (our guys) or ill (their guys) then in the absence of any other influence, companies go into those markets. <clip> This highlights the importance of the proactive tools that we are developing, like user submitted terms & UMA, along with the consent receipt for accountability. Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Notes from UMA telecon 2016-08-04
by Eve Maler 08 Aug '16

08 Aug '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-08-04 MinutesRoll call Quorum not reached. Critical mass for rough consensus reached. Approve minutes Approve minutes of UMA telecon 2016-06-30 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-30> , 2016-07-07 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-07-07> , 2016-07-14 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-07-14>: tbs Logistics - *Note:* No WG calls on August 11 and August 25. (Also no legal subgroup calls on August 12 and August 26.) - Do we want to refresh our "pointer Internet-Drafts" (core <https://www.ietf.org/archive/id/draft-hardjono-oauth-umacore-14.txt> and RSR <https://tools.ietf.org/html/draft-hardjono-oauth-resource-reg-07>), wait till we have new finished versions, or never update them again? If we have no opinion on the IETF I-D question, we'll take no action *at least* until we publish final versions of our next specs. Spec text update Eve shared status on our work against our roadmap <http://kantarainitiative.org/confluence/display/uma/UMA+Roadmap+for+2016>. We are substantially through the items, with the devil being in the detail (actual spec text). What's a reasonable timeframe for completion of said roadmap? Stability of specs with chance to implement and test by end of year, with ratification (membership voting) plans after that? Sarah thinks so. No other opinions expressed. [image: (smile)] Eve's thinking on the balance to be achieved: There's keen interest in wide ecosystem use cases, but pressure to get big changes right. Client awareness of scopes and set math See 2016-06-02 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-02> and 2016-06-16 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-16?…> notes. In the latter set of notes, there's a discussion about how clients are free to request more scopes and RS's are free to register fewer than what the client requested. George believes that the reason to allow the client to request scopes at all is to reduce chattiness (in the case that the client is smart enough to know what it wants and can handle). In other words, if the client knows it wants scopes A, B, and C, it can request all of them up front. And so we need to preserve the scope-unawareness flow when the client isn't that smart. Adrian adds that data minimization suggests that the client should ask for as few scopes that it needs to do its job; we should probably be adding some non-normative spec text in the security and privacy considerations about this, inspired by the OAuth specs. The RS, as an API publisher, will need to account for scopes that are common to the kinds of resource sets that they (the scopes) are on. The kinds/types/classes vs. instances (with rsid's) distinction is reminiscent of the solution we thought we came up with last week for standardizing FHIR/HEART resource set and scope semantics (or any standard/public API that is implemented by multiple API publishers). So, in terms of the list in the 06-02 list for set math purposes, there's a #0 on the list that is the "API documentation", likely in Swagger or Swagger++, which says "here are the scopes for this API and how to use them" and, if there are resource set types, "here are the resource set types with which the scopes are associated". That's the "class" level, whereas RSR is the "instance" (RO context) level. Clients have to implement what the API publisher says is available to implement. Standard APIs are only different from proprietary APIs in that the API documentation is standardized (and, perhaps, will include our "trick" for protection API extensibility profile). Is it recommended for security to register for the scopes they want? Is it hairy compared to other scopes because some scopes might be specific to only some resource sets? Actually, as long as the scopes are distinguished by URI in a per-resource set way, the friendly name could still be (say) "Read" and they'd be unique per resource set. This is up to the RS to manage. However, the actual registration process may look a bit different from today's OAuth scope registration process. Let's discuss client registration for scopes more next time. Spec text instructions (issue 159): - Now that the client can ask for scopes, add security and privacy considerations as mentioned above - Say something about how RS's need to include API documentation about scopes (as step 0), and how that ties to step 1 Client-to-AS-first flow Though we have put this aside for now, it's still on our 2016 roadmap docket. There is interest in it, and also a question about implications for HEART. Resource set ID context for standardized semantics profile idea See these notes <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-07-28> . We dug into this a tiny bit, but only insofar as it pushed the client awareness of scopes topic forward. Attendees As of 1 Aug 2016, quorum is 6 of 11. (Domenico, Sal, Nagesh, Andi, Robert, Paul, Maciej, Eve, Jeffrey, Mike, Sarah) 1. Domenico 2. Maciej 3. Eve 4. Sarah Non-voting participants: - Kathleen - Ishan - Robert - François - Adrian - Scott F - James - George Regrets: - Justin - Sal - John W - Mike *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 3

Re: [WG-UMA] [WG-InfoSharing] Article 29 Working Party Releases Opinion on the R...
by John Wunderlich 07 Aug '16

07 Aug '16

James; I’m unaware of such a group collaboration with respect to the GDPR, but would also love to find out about it if it exists. I’ve had to read the GDPR end to end a number of times recently for an engagement I had. It will be interesting to see how what you call, I think correctly, “a powerful point of view”, interacts with the also powerful forces of commercial inertia that have build the personal data ecosystem based on a de facto treatment of personal data as property. My experiences with large enterprises suggests that we are at the confluence of a number of development curves: 1. *Personal Data Economy*: This is how the Internet was monetized and is fully mature. It is predicated on contracts of adhesion or terms of use that enable one way doors for the collection of personal information by entities that then get to use that data as they see fit, with marginal constraints that appear occasionally if a particularly heinous security or privacy incident reaches a regulator or the press. This is in many ways a mature market. 2. *Big Data*: Moore’s law has put affordable big data on the table. Despite the hype in the media and with VC’s my suspicion is that actual useful big data installations are still at the Early Adopters stage. Much of the predicted profit from Big Data comes from the personal data economy and assumes unfettered access to data lakes of personal information . This is where ‘innovation’ is happening. And it’s not good for the GDPR or our personal data autonomy generally. Notwithstanding nattering about these innovations, large organizations with a dependency on the status quo will push back hard against anything that might require a change in business model or business processes. Similarly, startups seeking VC money tend to articulate their MVP in terms of existing schema for profit and monetization. A couple of cliché’s come to mind involving rocks and hard places or immovable objects and irresistible forces. This is why the Kantara Incubator <https://kantarainitiative.org/confluence/display/ccicada/Home> is so necessary and exciting. It presents researchers and startups with an opportunity to innovate against the mature personal data economy itself, rather than try and come up with news ways of monetization (which is essentially all that the current big data initiatives appear to be). I don’t know what the successor to the Personal Data Economy will be. It may be as simple as the Personalized Data Economy, where the locus of control shifts from the data controller to the subject. But it seems clear that the GDPR and the Personal Data Economy as it is currently constituted are mutually incompatible. - Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca On 7 August 2016 at 11:51, James Hazard <james.g.hazard(a)gmail.com> wrote: > Yes, nice summary. The official introduction to the GDPR - the > legislative whereas-es - is as good a work of digesting a complex legal > subject matter as I have ever seen. In its _173_ sections of introduction, > it touches on a great deal of the landscape - interactions of privacy, > security, national differences, technology, judicial systems, legislation, > etc. Yet still present a powerful point of view and specific positions. > > Is anyone aware of a place where this - the GDPR as a whole or the > introduction - is collaboratively commented? I would love to know of it. > > http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/? > uri=CELEX:32016R0679&from=EN > > > On Sun, Aug 7, 2016 at 6:47 AM, John Wunderlich <john(a)wunderlich.ca> > wrote: > >> Nice summary >> >> http://www.dataprotectionreport.com/2016/08/article-29- >> working-party-releases-opinion-on-the-revision-of-the-eprivacy-directive/ >> >> >> >> John Wunderlich, >> >> Sent frum a mobile device, >> Pleez 4give speling erurz >> >> "...a world of near-total surveillance and endless record-keeping is >> likely to be one with less liberty, less experimentation, and certainly far >> less joy..." A. Michael Froomkin >> >> >> >> This email and any files transmitted with it are confidential and >> intended solely for the use of the individual or entity to whom they are >> addressed. If you have received this email in error please notify the >> system manager. This message contains confidential information and is >> intended only for the individual named. If you are not the named addressee >> you should not disseminate, distribute or copy this e-mail. Please notify >> the sender immediately by e-mail if you have received this e-mail by >> mistake and delete this e-mail from your system. If you are not the >> intended recipient you are notified that disclosing, copying, distributing >> or taking any action in reliance on the contents of this information is >> strictly prohibited. >> >> _______________________________________________ >> WG-InfoSharing mailing list >> WG-InfoSharing(a)kantarainitiative.org >> http://kantarainitiative.org/mailman/listinfo/wg-infosharing >> >> > > > -- > @commonaccord > -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Creative names for consent in UMA [Legal]
by Adrian Gropper 06 Aug '16

06 Aug '16

Today's legal call was about the contract between the Grantor and the AS - or is it the ASO? As I understand it, we're looking for language to describe the relationship between the grantor / resource owner and her agent that will be operating an authorization service on her behalf. The section on Agents starts at page 67: http://docplayer.net/4194796-Restatement-of-the-law-agency-restatement-thir… The description of fiduciary duty seems to be quite clear. Page 72 deals with Principal's Consent. The key paragraphs are (my underline): - (1)(a)(ii) (ii) discloses all material facts that the agent knows, has reason to know, or should know would reasonably affect the principal's judgment unless the principal has manifested that such facts are already known by the principal *or that the principal does not wish to know them* - (1)(b) (b) the principal's consent concerns either a specific act or transaction, or acts or transactions of *a spe**cified type that could reasonably be expected to occur* in the ordinary course of the agency relationship. When Alice is informed about a particular transaction by the agent (in UMA this means that Alice is alerted to the specific RqP, Client, and Scopes) the situation is clear because Alice is more or less in the authorization loop. I would not use consent to describe this kind of transparency but IANAL. Under what circumstances can the Agent be less transparent? Regardless of our creativity in adding modifiers like "dynamic" to consent, the key points are underlined by me as - A positive statement by Alice that she doesn't want to be notified, or - A "specified type that could reasonably be expected to occur". I propose that the only way to get closure on this topic is by focusing on these two issues when Alice is signing a contract with an AS as a separate entity. The burden is on the ASO to adequately describe to Alice the specifications of the transactions that she will not be notified about and that are reasonably expected to occur. Alice would then use these descriptions in court in case of dispute. Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

2 3

Notes from UMA legal telecon 2016-08-05
by Eve Maler 05 Aug '16

05 Aug '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-08-05 - Review User-Managed Access (UMA) in Contractual and Regulatory Contexts <https://docs.google.com/a/wunderlich.ca/document/d/1HGM5-PoJFMnepyrTX91hqHK…> - Nailing down the right 1-2 paragraph scenario for use throughout the document (send your alternatives before the meeting) Attending: Eve, Kathleen, Andrew H, Adrian, Mary, Jim, John *NOTE:* No meeting next week! Regarding finding the right scenario: Smart home scenarios are really just as important due to sensitivity as health scenarios. In health research, it looks like the first BSC use case is going to get more complex still because real-life scenarios are getting blocked due to patients' reluctance to consent without a way to be notified of additional researchers' requests to access. Jim notes that "broad" consent is the key problem – anticipating future needs. And speaking of this, Adrian dislikes "informed" consent, because people don't know what's going to be done with it later. Transparency in being kept aware of status and where else the data is traveling is a key part of resource owner empowerment. Our discussion this time is ranging all over, but it all seems related to our hoped-for Regulatory section. Maybe we need a discussion in the Regulatory section about what "consent" maps to in UMA's "authorization" concept. There is a notion of authorization as a thing that can be dynamic – an RO can grant authorization and later revoke it (by an interaction with the AS that is actually outside the protocol but in scope for our model text), at a grain that is finer than Ts & Cs, and empowered by that grain, by the option to "Share" at will, and by the option to "un-share" any portion of the resource at will. John likes the phrase "Dynamic Consent"... It may be taken already. See this Nature article <http://www.nature.com/ejhg/journal/v23/n2/full/ejhg201471a.html>. Hazard@All: could have an obligation on the data user to destroy. Like my passport number for a hotel stay. Hazard@All: but once the other guy has it, we need to rely on some other method to have them delete it. Hazard@All: either contract or escrow Hazard@All: that is a matter of legal verbiage, I think Hazard@All: the lawyers phrase it however seems to work Hazard@All: and the vocabulary will change based on dozens of factors, including the common vocabulary of the business sector, jurisdiction and language Hazard@All: notice can be specified however you want - right? Hazard@All: you can use my stuff but you agree to text me whenever you do. Would we have to deal with privacy/data protection regulations as property-based vs. rights-based in our model text? We may very well, but it needs more discussion. Could Jeffrey apply his model? *AI:* Eve: Ask if Jeffrey would be willing to adapt his Information Governance school assignment into a small scenario for the primer, adding Alice to it, as an alternative scenario for consideration. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

FYI: Paper on cloud personal data privacy
by John Wunderlich 05 Aug '16

05 Aug '16

https://www.academia.edu/27238178/Approaches_on_Personal_Data_Privacy_Prese… Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Agenda for UMA legal telecon 2016-08-05
by Eve Maler 04 Aug '16

04 Aug '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 / US +1-805-309-2350 / international lines <https://www.turbobridge.com/join.html> / web interface <https://panel.turbobridge.com/webcall/>, code 178-2540# - Screen sharing: http://join.me/findthomas – NOTE: do not use the join.me dial-in line - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-08-05 - Review User-Managed Access (UMA) in Contractual and Regulatory Contexts <https://docs.google.com/a/wunderlich.ca/document/d/1HGM5-PoJFMnepyrTX91hqHK…> - Nailing down the right 1-2 paragraph scenario for use throughout the document (send your alternatives before the meeting) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Apple is trying to patent UMA
by Adrian Gropper 03 Aug '16

03 Aug '16

We must be on the right track. http://www.patentlyapple.com/patently-apple/2016/07/apples-patent-pending-i… Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

2 1

Sigh, I did not just mean to delete Thursday's call from our calendar
by Eve Maler 03 Aug '16

03 Aug '16

I'm putting it back right now. We're still on. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0