...
Date and Time
- Fridays, 8-9am PT
- Voice: Skype: +99051000000481 / US +1-805-309-2350 / international lines / web interface, code 178-2540#
- Screen sharingScreenshare and audio: http://join.me/findthomas – NOTE: do not use the join.me dial-in line
- UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar
2017-03-03
- Reviewing draft Legal deliverable #1
Attending: Eve, Tim, John W, Colin, Mark L
Logistics: Since Fri Mar 10 Eve can't meet, we will substitute Mon Mar 13 at 10am PT/1pm ET.
AI: Eve: Schedule the substitute meeting on the calendar.
Tim has deep experience in identity and authentication law (Virginia and unified US, ++). We are fortunate that he is a passionate legal UMAnitarian!
The first section in the doc is about goals. User "management" is about rights to control access. An ABA publication came out just today about IoT, addressing topics of data "ownership". Mark L talks about the distinction between Data Protection and Data Control, and UMA is really about reaching the latter. UMA goes beyond most of today's regulations, and that's what's groundbreaking. Tim believes "this could be the most significant legal tool in a thousand years".
Access control can have governance and economic functions. Data flow can unleash positive value. Business value and individual value can both be served in tandem by enabling selective sharing.
"Diachronic" consent/access control is about allowing ongoing changes and additions of information. Value can increase over time as information is shared. So this concept is directly related to business and individual value.
AI: Eve: Convert the use case document to GDoc form so we can comment/adjust live.
The Lex Informatica considerations are about ensuring that our global networks and global flows of data are accounted for. There need to be rules embedded in software and devices.
For the "F. Citizen-Facing Government Services" use case, what if we develop an additional use case that matches the OIX Pensions Dashboard use case, which is similar and another live topic of conversation?
Parking lot of topics for Tim and the group:
- Distinguishing between cases where there's a hard statutory reason to disclose data/give access (e.g. GDPR Article 6.1, HIPAA, etc.), and not giving the individual an opportunity to consent and say no (where access is given anyway), and cases where there's an organizational decision to reserve to itself data sharing rights with an opt-in that's not "data control"-friendly
- Adding "UMA salient factors" more specifically in the section after the use cases, including possibly proactive "Share" vs. reactive "Access Approval" (Opt-In with Choice) flow options
AI: Eve: Share RSA talk link, consent layers diagram, and the article with the articulation of "no data ownership".
AI: Eve: Reach out to Mike Pegman/David Rennie about possibly developing a companion use case for use case F.
AI: Eve: Reach out to the people who agreed to review the primer a long time ago, and ask them to look at the deliverable as it grows and see what they think (maybe enhanced with our "UMA technical definitions".
2016-12-16
- Use case/mapping exercise
- Toolkit discussion: roadmap?
- Legal as a WG vs. a subgroup
...