http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes... 2017-03-03 - Reviewing draft Legal deliverable #1 Attending: Eve, Tim, John W, Colin, Mark L *Logistics:* Since Fri Mar 10 Eve can't meet, we will substitute Mon Mar 13 at 10am PT/1pm ET. *AI:* Eve: Schedule the substitute meeting on the calendar. *Legal deliverable:* Tim has deep experience in identity and authentication law (Virginia and unified US, ++). We are fortunate that he is a passionate legal UMAnitarian! The first section in the doc is about goals. User "management" is about rights to *control* access. An ABA publication came out just today about IoT, addressing topics of data "ownership". Mark L talks about the distinction between Data Protection and Data Control, and UMA is really about reaching the latter. UMA goes beyond most of today's regulations, and that's what's groundbreaking. Tim believes "this could be the most significant legal tool in a thousand years". Access control can have governance and economic functions. Data flow can unleash positive value. Business value and individual value can both be served in tandem by enabling selective sharing. "Diachronic" consent/access control is about allowing ongoing changes and additions of information. Value can increase over time as information is shared. So this concept is directly related to business and individual value. *AI:* Eve: Convert the use case document to GDoc form so we can comment/adjust live. The *Lex Informatica* considerations are about ensuring that our global networks and global flows of data are accounted for. There need to be rules embedded in software and devices. For the "F. Citizen-Facing Government Services" use case, what if we develop an additional use case that matches the OIX Pensions Dashboard use case, which is similar and another live topic of conversation? Parking lot of topics for Tim and the group: - Distinguishing between cases where there's a *hard statutory reason* to disclose data/give access (e.g. GDPR Article 6.1, HIPAA, etc.), and not giving the individual an opportunity to consent and say no (where access is given anyway), and cases where there's an organizational decision to reserve to itself data sharing rights with an opt-in that's not "data control"-friendly - Adding "UMA salient factors" more specifically in the section after the use cases, including possibly proactive "Share" vs. reactive "Access Approval" (Opt-In with Choice) flow options *AI:* Eve: Share RSA talk link, consent layers diagram, the article with the articulation of "no data ownership", and snippets from the article on the Internet of Medical Things. *AI:* Eve: Reach out to Mike Pegman/David Rennie about possibly developing a companion use case for use case F. *AI:* Eve: Reach out to the people who agreed to review the primer a long time ago, and ask them to look at the deliverable as it grows and see what they think (maybe enhanced with our "UMA technical definitions". *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl