Notes from UMA Legal telecon 2017-03-17
http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes... 2017-03-17 - Reviewing use cases doc <https://docs.google.com/document/d/1otArZxgjNKCCqnlqswxKqgJ_0TnJOjJ3IywVz2U6-MY/edit?usp=sharing> Attending: Eve, Tim, Colin L, Adrian, John W, Ann Sal provided info on an event being held Mar 23 on Information Law <https://www.eventbrite.ie/e/information-law-2017-first-annual-conference-tickets-32256358637>. We also discussed Jim H's Wise Contracts paper <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2925871>and Jane Winn's comments in another context (BSC). This is relevant to Tim's intended matrix regarding allocation of economic value. Adrian sent a link <https://link.springer.com/article/10.1007%2Fs12553-017-0179-1#Sec10> to the Google DeepMind problem with trust, through extreme lack of transparency and communication with overseers. Eve's "golden rule" is to tell business owners that they should treat personal information as a joint asset. John W tells them the business owns the record while the individual controls the information. Note that OAuth's use of "resource owner", and thus UMA's effectively means control of access (to some extent/scope of access). Adrian "is alone in using" the definition of ownership where you can delete it. We've stayed away from "owning" terms so far for all these reasons, except at the technical level. Tim is listening for device connectivity, issues of content, and issues of context. For example, how to prove the connection of a device to a responsible mind? Eve points to a particular OAuth grant flow called OAuth Device Flow <https://tools.ietf.org/html/draft-ietf-oauth-device-flow> that helps to bind a device to a person and their account, which could help in an UMA context. Should we include a connected car use case? Here's an example <https://www.youtube.com/watch?v=8UFMJo9P_Fo&feature=youtu.be> we could potentially use. Regarding the distinction about the legal bases for collecting and using data (and also for presenting interfaces and granting access beyond just "collecting and using data", keeping in mind that UMA can protect any API – think "resource controller" vs. just "data controller"), is this exactly the bright line that lets us say that this lets the resource server be a "resource owner" for those resources that it doesn't give Alice the rights to control access to? This may be tautological because UMA has a notion of enterprise ROs anyway. Bridging terminology thoughts: - From resource server to resource server operator to resource controller to data controller???? *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl
Sorry to have not been there, and happy to follow up on the "Wise Contracts" paper. The Berkeley Center for Law and Technology has its annual privacy conference (in Palo Alto) on March 24. I would love to connect with anyone else who will also be there, or nearby. https://www.law.berkeley.edu/research/bclt/upcoming-events/6th-annual-bclt-p... A good format for "prose objects" is git repos. Here is a GDPR-refactoring privacy "policy". http://source.commonaccord.org/index.php?action=source&file=G/EU-GDPR-Law-CmA/PrivacyPolicy/Form/0.md Others in the collection at /G/ (for git). On Fri, Mar 17, 2017 at 10:35 AM, Eve Maler <eve@xmlgrrl.com> wrote:
http://kantarainitiative.org/confluence/display/uma/UMA+ legal+subgroup+notes#UMAlegalsubgroupnotes-2017-03-17 2017-03-17
- Reviewing use cases doc <https://docs.google.com/document/d/1otArZxgjNKCCqnlqswxKqgJ_0TnJOjJ3IywVz2U6-MY/edit?usp=sharing>
Attending: Eve, Tim, Colin L, Adrian, John W, Ann
Sal provided info on an event being held Mar 23 on Information Law <https://www.eventbrite.ie/e/information-law-2017-first-annual-conference-tickets-32256358637>. We also discussed Jim H's Wise Contracts paper <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2925871>and Jane Winn's comments in another context (BSC). This is relevant to Tim's intended matrix regarding allocation of economic value.
Adrian sent a link <https://link.springer.com/article/10.1007%2Fs12553-017-0179-1#Sec10> to the Google DeepMind problem with trust, through extreme lack of transparency and communication with overseers. Eve's "golden rule" is to tell business owners that they should treat personal information as a joint asset. John W tells them the business owns the record while the individual controls the information. Note that OAuth's use of "resource owner", and thus UMA's effectively means control of access (to some extent/scope of access). Adrian "is alone in using" the definition of ownership where you can delete it. We've stayed away from "owning" terms so far for all these reasons, except at the technical level.
Tim is listening for device connectivity, issues of content, and issues of context. For example, how to prove the connection of a device to a responsible mind? Eve points to a particular OAuth grant flow called OAuth Device Flow <https://tools.ietf.org/html/draft-ietf-oauth-device-flow> that helps to bind a device to a person and their account, which could help in an UMA context. Should we include a connected car use case? Here's an example <https://www.youtube.com/watch?v=8UFMJo9P_Fo&feature=youtu.be> we could potentially use.
Regarding the distinction about the legal bases for collecting and using data (and also for presenting interfaces and granting access beyond just "collecting and using data", keeping in mind that UMA can protect any API – think "resource controller" vs. just "data controller"), is this exactly the bright line that lets us say that this lets the resource server be a "resource owner" for those resources that it doesn't give Alice the rights to control access to? This may be tautological because UMA has a notion of enterprise ROs anyway.
Bridging terminology thoughts:
- From resource server to resource server operator to resource controller to data controller????
*Eve Maler*Cell +1 425.345.6756 <(425)%20345-6756> | Skype: xmlgrrl | Twitter: @xmlgrrl
_______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/wg-uma
-- @commonaccord
Really like the refactoring of privacy policy here James :-)
On 17 Mar 2017, at 17:47, James Hazard <james.g.hazard@gmail.com> wrote:
Sorry to have not been there, and happy to follow up on the "Wise Contracts" paper.
The Berkeley Center for Law and Technology has its annual privacy conference (in Palo Alto) on March 24. I would love to connect with anyone else who will also be there, or nearby. https://www.law.berkeley.edu/research/bclt/upcoming-events/6th-annual-bclt-p... <https://www.law.berkeley.edu/research/bclt/upcoming-events/6th-annual-bclt-privacy-law-forum-silicon-valley/>
A good format for "prose objects" is git repos. Here is a GDPR-refactoring privacy "policy". http://source.commonaccord.org/index.php?action=source&file=G/EU-GDPR-Law-CmA/PrivacyPolicy/Form/0.md <http://source.commonaccord.org/index.php?action=source&file=G/EU-GDPR-Law-CmA/PrivacyPolicy/Form/0.md> Others in the collection at /G/ (for git).
On Fri, Mar 17, 2017 at 10:35 AM, Eve Maler <eve@xmlgrrl.com <mailto:eve@xmlgrrl.com>> wrote: http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes... <http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes#UMAlegalsubgroupnotes-2017-03-17> 2017-03-17 Reviewing use cases doc <https://docs.google.com/document/d/1otArZxgjNKCCqnlqswxKqgJ_0TnJOjJ3IywVz2U6-MY/edit?usp=sharing> Attending: Eve, Tim, Colin L, Adrian, John W, Ann Sal provided info on an event being held Mar 23 on Information Law <https://www.eventbrite.ie/e/information-law-2017-first-annual-conference-tickets-32256358637>. We also discussed Jim H's Wise Contracts paper <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2925871>and Jane Winn's comments in another context (BSC). This is relevant to Tim's intended matrix regarding allocation of economic value. Adrian sent a link <https://link.springer.com/article/10.1007%2Fs12553-017-0179-1#Sec10> to the Google DeepMind problem with trust, through extreme lack of transparency and communication with overseers. Eve's "golden rule" is to tell business owners that they should treat personal information as a joint asset. John W tells them the business owns the record while the individual controls the information. Note that OAuth's use of "resource owner", and thus UMA's effectively means control of access (to some extent/scope of access). Adrian "is alone in using" the definition of ownership where you can delete it. We've stayed away from "owning" terms so far for all these reasons, except at the technical level. Tim is listening for device connectivity, issues of content, and issues of context. For example, how to prove the connection of a device to a responsible mind? Eve points to a particular OAuth grant flow called OAuth Device Flow <https://tools.ietf.org/html/draft-ietf-oauth-device-flow> that helps to bind a device to a person and their account, which could help in an UMA context. Should we include a connected car use case? Here's an example <https://www.youtube.com/watch?v=8UFMJo9P_Fo&feature=youtu.be> we could potentially use. Regarding the distinction about the legal bases for collecting and using data (and also for presenting interfaces and granting access beyond just "collecting and using data", keeping in mind that UMA can protect any API – think "resource controller" vs. just "data controller"), is this exactly the bright line that lets us say that this lets the resource server be a "resource owner" for those resources that it doesn't give Alice the rights to control access to? This may be tautological because UMA has a notion of enterprise ROs anyway. Bridging terminology thoughts: From resource server to resource server operator to resource controller to data controller????
Eve Maler Cell +1 425.345.6756 <tel:(425)%20345-6756> | Skype: xmlgrrl | Twitter: @xmlgrrl
_______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org <mailto:WG-UMA@kantarainitiative.org> http://kantarainitiative.org/mailman/listinfo/wg-uma <http://kantarainitiative.org/mailman/listinfo/wg-uma>
-- @commonaccord _______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/wg-uma
Mark, thanks. I played (and @umawg played back) with the hashtag #ProseChain to refer to these kinds of integrated solutions, where there is a chain of provenance on the text of, roughly: legislation -> regulation -> model document -> company -> citizen https://twitter.com/UMAWG/status/843485680235819008 On Sun, Mar 19, 2017 at 4:19 AM, Mark <mark@smartspecies.com> wrote:
Really like the refactoring of privacy policy here James :-)
On 17 Mar 2017, at 17:47, James Hazard <james.g.hazard@gmail.com> wrote:
Sorry to have not been there, and happy to follow up on the "Wise Contracts" paper.
The Berkeley Center for Law and Technology has its annual privacy conference (in Palo Alto) on March 24. I would love to connect with anyone else who will also be there, or nearby. https://www.law.berkeley.edu/research/bclt/upcoming-events/ 6th-annual-bclt-privacy-law-forum-silicon-valley/
A good format for "prose objects" is git repos. Here is a GDPR-refactoring privacy "policy". http://source.commonaccord.org/index.php?action=source& file=G/EU-GDPR-Law-CmA/PrivacyPolicy/Form/0.md Others in the collection at /G/ (for git).
On Fri, Mar 17, 2017 at 10:35 AM, Eve Maler <eve@xmlgrrl.com> wrote:
http://kantarainitiative.org/confluence/display/uma/UMA+lega l+subgroup+notes#UMAlegalsubgroupnotes-2017-03-17 2017-03-17
- Reviewing use cases doc <https://docs.google.com/document/d/1otArZxgjNKCCqnlqswxKqgJ_0TnJOjJ3IywVz2U6-MY/edit?usp=sharing>
Attending: Eve, Tim, Colin L, Adrian, John W, Ann
Sal provided info on an event being held Mar 23 on Information Law <https://www.eventbrite.ie/e/information-law-2017-first-annual-conference-tickets-32256358637>. We also discussed Jim H's Wise Contracts paper <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2925871>and Jane Winn's comments in another context (BSC). This is relevant to Tim's intended matrix regarding allocation of economic value.
Adrian sent a link <https://link.springer.com/article/10.1007%2Fs12553-017-0179-1#Sec10> to the Google DeepMind problem with trust, through extreme lack of transparency and communication with overseers. Eve's "golden rule" is to tell business owners that they should treat personal information as a joint asset. John W tells them the business owns the record while the individual controls the information. Note that OAuth's use of "resource owner", and thus UMA's effectively means control of access (to some extent/scope of access). Adrian "is alone in using" the definition of ownership where you can delete it. We've stayed away from "owning" terms so far for all these reasons, except at the technical level.
Tim is listening for device connectivity, issues of content, and issues of context. For example, how to prove the connection of a device to a responsible mind? Eve points to a particular OAuth grant flow called OAuth Device Flow <https://tools.ietf.org/html/draft-ietf-oauth-device-flow> that helps to bind a device to a person and their account, which could help in an UMA context. Should we include a connected car use case? Here's an example <https://www.youtube.com/watch?v=8UFMJo9P_Fo&feature=youtu.be> we could potentially use.
Regarding the distinction about the legal bases for collecting and using data (and also for presenting interfaces and granting access beyond just "collecting and using data", keeping in mind that UMA can protect any API – think "resource controller" vs. just "data controller"), is this exactly the bright line that lets us say that this lets the resource server be a "resource owner" for those resources that it doesn't give Alice the rights to control access to? This may be tautological because UMA has a notion of enterprise ROs anyway.
Bridging terminology thoughts:
- From resource server to resource server operator to resource controller to data controller????
*Eve Maler*Cell +1 425.345.6756 <(425)%20345-6756> | Skype: xmlgrrl | Twitter: @xmlgrrl
_______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/wg-uma
-- @commonaccord _______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/wg-uma
-- @commonaccord
participants (3)
-
Eve Maler -
James Hazard -
Mark