(If you want to discuss particular points, please consider starting a new email thread with a different subject line.) https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note... 2019-07-09 Attending: Eve, Lisa, Adrian, Domenico, Andi, Thomas, Tim, Colin (regrets: Cigdem, Nancy) Eve briefly walked through the paper that she and Lisa have submitted to the IEEE ComSoc CfP https://www.comsoc.org/publications/magazines/ieee-communications-standards-.... It's called Beyond Consent: A Right-to-Use Licensing Agreement for Mutual Agency. The argument made by the paper is that digital consent and Terms acceptance (perceived as consent) are failing and don't meet a strict definition of consent (Nancy Kim's *Consentability https://www.amazon.com/Consentability-Consent-Nancy-S-Kim-ebook/dp/B07N45GFR3/ref=sr_1_1?crid=JR0QMFLW30KV&keywords=consentability+consent+and+its+limits&qid=1562688224&s=gateway&sprefix=consentability%2Caps%2C231&sr=8-1* framework is used), and using a Me2B https://www.me2b.us/ lens (centering on the user of the digital services) shows that a licensing agreement is more appropriate. A taxonomy for license agreement contents is proposed, and some challenges are discussed. The paper points to the UMA report where a license is already proposed, but starts "earlier" in the personal data usage chain to be more comprehensive. What about consent receipts? They record the results of consent. Lisa and Eve meant to cite them in the paper and hope to have a chance to add this. Adrian discusses a link between DIDs and standards such as UMA; the link is what's called the service endpoint. The DTD standards don't talk about what the service endpoint might be. They're trying to put a personal data store there. Thomas spoke with Microsoft's Ankur Patel (who was with Preeti Rastogi) at Identiverse about the challenge of getting personal data into wallets/personal data stores. There seems to be a lack of recognition of this challenge. It should be kept in mind that the paper treats personal data permission use cases that go beyond UMA. Tim recommends removing the "IANAL" disclaimer in the paper! Lisa and Eve have both worked with many lawyers and have sourced ideas from legal experts. We started to walk through the Right-to-Use License Agreement (Figure 5 in the paper) and analyze which would already be baked into some artifact, such as the RPT, and which might need to be captured separately. For example, the digital asset, grantee (licensee), and actions, would be captured as resource ID, requesting party and client, and scopes. But other information might need to be captured in some other structure, with perhaps a link off to it that is stored in the token. If a requesting party or client received and agreed to such a license, maybe by signing it, the result might be a "receipt". Trunomi has something called a "certificate", which sounds similar, as their consent receipt. Eve will email a copy of the paper to all interested to review. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl