Although that report avoids making suggestions, the only solution I can imagine is adoption of GDPR-like regulations. Privacy policies may play a role, but unless these are structured and standardized to some extent, either voluntarily or by regulation, they will not promote the kind of broad voluntary adoption that we need in health, IoT, and beyond. Right now, the only company with a simple, voluntary structure to its privacy policy is Apple Health that simply says: "Apple will not see your data.". I can imagine support for a user-specified UMA authorization server as another dimension of a structured privacy policy. To Eve's point, there was a time when "free"email services did not support a standard API but those days are long gone. The UMA AS needs to be next. Adrian On Saturday, July 30, 2016, Eve Maler wrote:

(Note: Those without posting privileges to one or the other list won't be able to reply to both, as I am replying here.)

This is where it's interesting to examine examples of where it's being done. Some services, apps, SDKs, OSes, and other types of platforms do it. Some do it in response to having been caught out by the media in a problem (so, public pressure can work in some circumstances, even if there's no direct compliance pressure). As my analyst friend likes to point out, the US doesn't force dairy products to avoid rBST, but ~75% of dairy products are rBST free anyway because of consumer demand...

As you've no doubt gotten tired of my pointing out :-), the "Alice-to-Bob" delegation features in Google Apps, TripIt, and Flicker weren't put there in response to a risk management need: They were added as value-add app functionality.

Each has different reasons for doing so. I tend to choose mobile apps that let me pay in money instead of personal data, as they tend to have "superior" (from my perspective) privacy notices that are more respectful of my data (I shared one of those on these lists a while back).

*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

On Sat, Jul 30, 2016 at 4:00 AM, John Wunderlich javascript:_e(%7B%7D,'cvml','john@wunderlich.ca');> wrote:

...

The predecessor and marketing problem before UMA or CISWG is how to get entities that aren't required to give users control over their own data to do so.

https://www.healthit.gov/sites/default/files/non-covered_entities_report_jun...

Thanks, John 4giv spellin errurz from mobile devize

This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

_______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org javascript:_e(%7B%7D,'cvml','WG-UMA@kantarainitiative.org'); http://kantarainitiative.org/mailman/listinfo/wg-uma