[This was our last biz-legal meeting of the year. We do still have one more "regular" WG call this Thursday.] https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note... 2019-12-17 Attending: Eve, Cigdem, Domenico, Lisa, Colin Note that we did rename (renumber) the states, so that the "little Johnny" use case is now State 2 because it's the next most common. Domenico shared a great new non-tabular graphic that is helping us think about what we really mean by the first four states. (See the wiki version of these notes for the graphic.) In the "Mapping graphics" deck, Eve had put some comments about needing to see the DS-as-RRA aspect as donning a role, and Cigdem raised this as well. The states we've been talking about are at a pretty operational level, meaning they allow us to specify details of implementation such as role changes and provisioning/deprovisioning requirements that could built into compound workflows. We're likely to have to go to the level of tackling the "multiple Data Subjects" use cases. In healthcare, you could commonly have state transitions like 2-4-1, or 2-4-2-1 as little Johnny has his mother added to manage his EHR, then his father, then grows up and starts managing his own resources. We actually map cradle-to-grave scenarios somewhat like this in the "Legal role definitions" deck. How does one map three-dimensional values in two-dimensional space? You split out one of the dimensions to two flat ones, or you have multiple tables. Ugh. We observe that adding and removing RRAs is a provisioning/deprovisioning action, and adjusting whether the DS is one of the RRAs is a role change action, what if we think of this as two different "tables" (maybe tables in a technical viewpoint, but potentially not for the document)? They're orthogonal actions, which could be built up to form a "workflow" that triggers when you need to move from one state to another, like when Johnny e.g. hits a certain age, or succeeds in asking the court to be emancipated from his parents, or when a couple divorces, or when a temperature sensor hits a certain temperature, etc. There can be harder edge cases for what to do around, say, historical bank account data vs. new data going forward in the case of multiple-down-to-single bank account data. What do banks do today? Do they close the joint account and open a new single-owner account for the newly divorced person? Lisa shared a great "IRL mapping sketch https://onedrive.live.com/view.aspx?resid=B50E88B19F3E012!68813&ithint=file%2cpptx&authkey=!AOrgTTmj8WmbKxMhttps://1drv.ms/p/s!AhLg8xmL6FALhJlN6uBNOaPxaZsrEw?e=fp4D5Y" that is inspiring us to add a graphical version of the "typical use case" to the doc. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl