Anchored Notice and Consent Receipt (ANCR) Record for Operational Transparency

Version: 0.8.9.2

Document Date: September 1923, 2022

Editor(s): Mark Lizar, Sharon Polsky

Contributors: Sal D’Agostino,

Contributing Orgs: Open Consent Group/0PN C.I.C, Privacy & Access Council of Canada,

...

At the present time, when online services are involved, Individuals have no way of seeing or knowing who is in control of collecting, using, processing, or disclosing their personal information before the collection, use, processing, or disclosure takes place. Individuals are powerless to resist or object to the one-size-fits-all contracts presented on websites that are called ‘terms and conditions’, ‘user licenses’, ‘privacy policies’ or ‘data sharing agreements’, but which that do not facilitate human-centric dynamic data exchangesimplement privacy people expect.

No mechanism is currently available for Individuals to assert authority in advance of disclosing their personal information; and no way for them to determine, control, or negotiate the conditions or sources under which data about them may be processed, used, managed, or associated with other data consent.

Individuals are prevented Lack of transparency and consent defaults prevent Individuals from knowing or seeing (therefore trusting or controlling) when digital identifiers and related meta data metadata about themselves is are created, used, or disclosed, or , for additional purposes

Systemically prohibiting interaction, access and participation required for individuals to see how information about themselves is used, when, by whom, and for what purposes.

Enabling individuals to see how information about themselves is used, when, by whom, and for what purposes, requires a standardized transparency mechanism as a way to provide data governance that scales when decentralized.

The ANCR Record provides standardized transparency that enables Individuals to know Anchored Notice and Consent Record implements a standard of transparency to enable Individuals to see if PII about them is kept being used in ways that are private and whether, when, where, and to whom it is disclosed — locally, domestically, or internationally.

The ability to direct and control the collection, use and disclosure of information about themselves is essential for Individuals to have reason technical capacity to trust the management of surveillance, personal identity, and advanced digital data analysis technologies.

This specification provides a mechanism to provide implement legal and technical standards for transparency to supplant that supersede ‘terms and conditions’, ‘user licenses’, ‘privacy policies’ and ‘data sharing agreements’, to facilitate human-centric dynamic data exchanges. Specifying an active technical object for managing the rules of data and its consented exchange.

The ANCR process creates a record of operational transparency over data control and processing that works to regulate surveillance from offline and online activities, in much the same way as financial transactions are now regulated and tracked.

The Anchored Notice and Consent Receipt (ANCR) Record specification enables individuals (i.e., a PII Principal) to create employ a single-use Record of Notice 3-layer notice record schema to indicate their consent for a specific data exchange. PII Principals can enhance the single use Record of Notice record schema with a layer 2 schema that incorporates a digital identifier to serve as proof of notice for the repeated use of a consented data exchange.A receipt and record of processing provides transparency of a ‘proof of notice’ record for repeated use in concentric data exchanges.

The 3^rd notice record schema is the anchored notice records is a private information (identity relationship) record, which considers security requirements as a pre-condition for generating records and receipts in identifier management systems.

Finally, an active technical record of processing activities provides for the PII Principal in context transparency over who is accountable for — and is a pre-condition of — processing Personally Identifiable Information (PII) , and provides scalable governance and security. Finally, the Anchored Notice and Consent Record is a private information record, specified here as a separate record, which takes into account security requirements not as considerations but, rather, as a pre-condition for generating consent records in identity management and other systemsfor human interoperable governance and security.

In this first rendition of the ANCR framework specification it is the PII Principal who manages consentconsented surveillance, and the processors who each manage and comply with the permission grant defined by the PII Principal. To this point, this specification focuses on transparency of control, with extensions for extending the transparency of a controller with purpose specification as outlined in Annex.

Specification Components

The ANCR Record specification provides the permissions granted for a specified purpose and scope. To this point, this specification focuses on transparency performance for the assessment of data control and it’s impact. Including 3 ANCR Framework Extensions summarized in the Appendix for extending the transparency over data control with,

• Extension 1: consented purpose specification

• Extension 2: data treatment and right based controls

• Extension 3: bundling codes of conduct and practice in implementation

Subsequent iterations and extension of this specification focus on a Controller Credential agnostic to identifier technology. The use of notice records as a Micro- credentials and consent receipt as tokens for proof of notice for any of the 6 legal justifications for processing as well as evidence of electronic consent.

Specification Components

This introduction demonstrates the use of a 29100 record for processing to illustrate the use of 29184 controls to assess performance of this record.

The ANCR Record specification introduces three (3) transparency performance indicators (TPIs) that an Individual can use to assess an organization’s transparency — in particular how it collects, uses, and discloses Personally Identifiable Information — before electing to provide their personally identifiable information or authorize its collection, use, processing, or disclosure.

...

This document has been prepared by Participants of Kantara Initiative , Inc. Permission is hereby granted to use the document solely for the purpose of implementing the Specification. No rights are granted to prepare derivative works of this Specification. Entities seeking permission to reproduce this document, in whole or in part, for other uses must contact the Kantara Interative Initiative to determine whether an appropriate license for such use is available.

...

International laws and standards — including ISO/IEC 29100 Security and Privacy Framework — are the international framework for creating records for trustworthy ‘consented data access’, for adequate data transfers internationally; and provide an opportunity to implement a low-cost digital records (twin) record and receipt mechanism and thus dramatically improve the security of personal data control, thereby increasing the effectiveness of cyber physical security and digital privacy.

...

The Notice Record is specified for generating operational transparency with the use of the controls in ISO/IEC 29184 Online Privacy Notices and Consent and evidenced with anchored notice and consent receipts. [ISO/IEC 29184, Appendix B]

Why was this specification written?

An internationally - standardized notice and consent record information structure provides the standard for a PII Principal to generate records independently of the PII Controller, and to hold, control and manage, separately from the PII Controller access to withdraw consent. This specification is proposed to capture, measure, and standardize the transparency of PII Controllers’ security and privacy practice through the entire lifecycle of personal information collected from a PII Principal.

...

Standardized digital notice is a steppingstone to digital operational privacy and is required to scale human to system (electronic) consent online. A record that is provided by default using standard digital identifier governance defaults, designed for self-sovereign/human centric transparency and interoperability, between people and systems.

...

For this purpose, the ANCR record is first specified as a single use record, that the Individual controls with 3 transparency performance indicators. First defined as a single use record to generate a record the Individual can own, control and trust. The KPI’s provided here are specified to provide transparency over data control and it’s human/decentralized data governance. (specified Specified as Operational Transparency),

...

The Notice Record is first specified as a static, one-time use notice record that is created by the PII Principal and used to initiate a state of operational transparency in context measured by access to, and performance of, rights.

Diagram 1: Notice Record

...

(TBD_

Anchor
_Toc114497431 _Toc114497431

Table1: Single Use Notice Record:
PII Controller Identity AND Contact Transparency Report

Anchor
_Toc114497432 _Toc114497432

Anchoring the Notice Record for Trust

...

Anchor
_Toc114372114 _Toc114372114

Anchor
_Toc114373615 _Toc114373615

Anchor
_Toc114373712 _Toc114373712

Anchor
_Toc114397916 _Toc114397916

Anchor
_Toc114372115 _Toc114372115

Anchor
_Toc114373616 _Toc114373616

Anchor
_Toc114373713 _Toc114373713

Anchor
_Toc114397917 _Toc114397917

Anchor
_Toc114497434 _Toc114497434

Transparency Accessibility Rating description table 2

TPI 3: Certificate (and/or Key) Security Transparency

...

Anchor
_Toc114497435 _Toc114497435

Table 2 : Notice Record TPI Report

Anchor
_1t3h5sf _1t3h5sf

Anchor
_Toc108928874 _Toc108928874

Anchor
_Toc498675757 _Toc498675757

Anchor
_Toc114497436 _Toc114497436

Notice Record References

...

• ANCR Record — means the Anchored Notice Record and Consent Receipt Record

• ANCR WG — means the Advanced Notice and Consent Receipt Work Group

• Array — means an array of field objects

• Conv. 108+ — means the Council of Europe Convention 108+

• FIPP — means Fair Information Practice Principles

• IRM — means Identifier Relationship Management

• ISO/IEC — means International Organization for Standardization/International Electrotechnical Commission

• Object — means a field object

• PII — means Personally Identifiable Information

• POMME — means Privacy Operationalization Model and Method for Engineering

• ZPN – Zero Public Network – a network in which each processor of personal information has a controller credential and the PII Principal has a private record of the credential

Anchor
_Toc114497440 _Toc114497440

Code of Conduct

...

The types of Concentric Notice Label are specified in Annex B, which spans the spectrum of legally defined consent types, defined from for the individual’s context and perspective.

Anchor
_Toc114497442 _Toc114497442

...

ConCentric Notice Label Types

Not Concentric: Legal obligation or legitimate interest independent of PII Principal

...

Anchor
_Toc114497446 _Toc114497446

Proof of Notice

A Consent Notice Receipt, for a proof of notice, used as evidence of consent and

...

to ...demonstrate compliant records of processing activities.

[Source: ISO/IEC 29184 Appendix B]

A Record of Notice that is generated to provide proof of an informed individual supersedes terms and conditions (contract), to implement overarching privacy rights‑based control.

[Source: ANCR Notice Record v1 – Specification]

Anchor
_z337ya _z337ya

Anchor
_Toc108928885 _Toc108928885

Anchor
_Toc114497447 _Toc114497447

Personally Identifiable Information (PII)

Any information that (a) can be used to identify the PII Principal to whom Personally Identifiable Information relates, or (b) is or might be directly or indirectly linked to a PII Principal.

NOTE: To determine whether or not an individual should be considered identifiable, several factors need to be taken into account. (Equivalent with personal data)

[Source: ISO/IEC 29100]

Descriptor for a type of Personally Identifiable Information, or a set of types of Personally Identifiable Information

[Source: ISO/IEC 29184 3.3]

Personal Data means any information relating to an identified or identifiable natural person.

Data Subject means an identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

[Source: Conv. 108+ Rec 16]

Anchor
_Toc114497448 _Toc114497448

PII that is in a Sensitive (or Special) Category

What constitutes Sensitive PII is defined explicitly in legislation; however, the definition might vary across jurisdictions. Sensitive PII might include information revealing race, ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, sexual lifestyle or orientation, and the physical or mental health of the PII Principal. In other jurisdictions, sensitive PII might include information that could facilitate identity theft or otherwise result in significant emotional, psychological, or financial harm to the natural person (e.g., credit card numbers, bank account information, or government-issued identifiers such as passport numbers, social security numbers or drivers’ license numbers), and information that could be used to determine the PII Principal’s real time location.

[Source: ISO/IEC 29100 4.4.7]

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.

[Source: GDPR Art 9.1]

Sensitive PII should not be processed unless the specific conditions set out in this Regulation are met. Those personal data should include personal data revealing racial or ethnic origin, whereby the use of the term ‘racial origin’ in this Regulation does not imply an acceptance by the Union of theories which attempt to determine the existence of separate human races. The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person. In addition to the specific requirements for processing of sensitive data, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing. Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided, inter alia, where the Data Subject gives his or her explicit consent or in respect of specific needs, in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms.

[Source: Conv. 108+ Rec, 29]

Anchor
_3j2qqm3 _3j2qqm3

Anchor
_Toc108928886 _Toc108928886

Anchor
_Toc114497449 _Toc114497449

PII Principal

...

(also Data Subject or Individual)

The natural person to whom the personally identifiable information (PII) relates.

NOTE: Depending on the jurisdiction and the particular data protection and privacy legislation, the synonym “Data Subject” can also be used instead of the term “PII Principal.”

[Source: ISO 29100 2.11]

PII Principals provide their PII for processing to PII Controllers and PII processors and, when it is not otherwise provided by applicable law, they give consent and determine their privacy preferences for how their PII should be processed. PII Principals can include, for example, an employee listed in the human resources system of a company, the consumer mentioned in a credit report, and a patient listed in an electronic health record. It is not always necessary that the respective natural person is identified directly by name in order to be considered a PII Principal. If the natural person to whom the PII relates can be identified indirectly (e.g., through an account identifier, social security number, or even through the combination of available attributes), he or she is considered to be the PII Principal for that PII set.

[Source: ISO 29100 4.2.1]

Personal Data means any information relating to an identified or identifiable natural person (‘Data Subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

[Source: GDPR: Article 4.1]

Individual: Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

[Additive: PIPEDA 4.9]

Anchor
_1y810tw _1y810tw

Anchor
_Toc108928887 _Toc108928887

Anchor
_Toc114497450 _Toc114497450

PII Controller

A privacy stakeholder (or privacy stakeholders) who determines the purposes and means for processing Personally Identifiable Information (PII) other than natural persons who use data for personal purposes.

NOTE: A PII Controller sometimes instructs others (e.g., PII processors) to process PII on its behalf while the responsibility for the processing remains with the PII Controller.

[Source: ISO 29100]

‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

Note: Also known as a Data Controller.

[Source: GDPR Art. 4(7)]

‘Controller’ means the Union institution or body or the directorate-general or any other organisational entity which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by a specific Union act, the controller or the specific criteria for its nomination can be provided for by Union law;

[Source: Conv 108+ Art 3(8)]

Anchor
_4i7ojhp _4i7ojhp

Anchor
_Toc108928888 _Toc108928888

Anchor
_Toc114497451 _Toc114497451

PII Joint Controller

Covers multiple joint controller relationships including co-controllers, hierarchical, fiducial, and code.

Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the Data Subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for Data Subjects.

[Source: GDPR Art 26.1]

Where two or more controllers or one or more controllers together with one or more controllers other than Union institutions and bodies jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with their data protection obligations, in particular as regards the exercise of the rights of the Data Subject and their respective duties to provide the information referred to in Article 79, by means of an arrangement between them, unless and in so far as the respective responsibilities of the joint controllers are determined by Union or Member State law to which the joint controllers are subject. The arrangement may designate a contact point for Data Subjects.

[Source: Conv 108+ Art 86.1]

Anchor
_2xcytpi _2xcytpi

Anchor
_Toc108928889 _Toc108928889

Anchor
_Toc114497452 _Toc114497452

PII Processor

A privacy stakeholder that processes personally identifiable information (PII) on behalf of and in accordance with the instructions of a PII Controller.

[Source: ISO 29100]

'processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

[Source: GDPR Art 4(8)]

‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

[Source: Conv. 108+ Art 3(12)]

Anchor
_1ci93xb _1ci93xb

Anchor
_Toc108928890 _Toc108928890

Anchor
_Toc114497453 _Toc114497453

PII Sub-Processor

Refers to the PII Controller type in the ANCR record specification.

[ANCR Notice Record Specification v0.9]

An additional field to indicate a delegated PII Processor (rather than 3^rd Party). Used to distinguish between, a legally authorized 3^rd Party, like a public health authority, who would themselves be a PII Controller, for that legal justification. Also found in the W3C Data Privacy Vocabulary.

[Additive: W3C DPV 2.3.1.6 http://w3c.github.io/dpv/dpv/ ]

Anchor
_3whwml4 _3whwml4

Anchor
_Toc108928891 _Toc108928891

Anchor
_Toc114497454 _Toc114497454

Processing of PII

An operation or set of operations performed on personally identifiable information (PII).

NOTE: Examples of processing operations of PII include, but are not limited to, the collection, storage, alteration, retrieval, consultation, disclosure, anonymization, pseudonymization, dissemination or otherwise making available, deletion or destruction of PII.

[Source: ISO 29100]

‘Processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

[Source: GDPR Art 4.2]

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

[Source. Convention 108+]

Anchor
_2bn6wsx _2bn6wsx

Anchor
_Toc108928892 _Toc108928892

Anchor
_Toc114497455 _Toc114497455

PII Regulator

Refers to a government authority responsible for the enforcement of privacy and data protection regulation. Referred to also as a Data Governance Authority, a Data Protection Authority (DPA) or simply Privacy Regulator.

Privacy Stakeholder

A natural or legal person, public authority, agency or any other body that can affect, be affected by, or perceive themselves to be affected by a decision or activity related to personally identifiable information (PII) processing.

[Source: ISO 29100]

Engage relevant stakeholders in discussion and activities aimed at furthering international cooperation in the enforcement of legislation for the protection of personal data;

[Source: GDPR Art. 50(c)]

Engage relevant stakeholders in discussion and activities aimed at furthering international cooperation in the enforcement of legislation for the protection of personal data;

[Source: Conv.108+ Art 51(c)]

...

Table A.1 — Mapping ISO/IEC 29100 concepts to ISO/IEC 27000 concepts

[Source: ISO/IEC 29100: Annex A]

...

[Source: ISO/IEC 29100: Annex A]

Anchor
_Toc114497457 _Toc114497457

Stanard Concentric clauses

Standard Concentric Clauses implement 29184 compliance controls and Privacy Service Agreements [ISO/IEC TS 27570: 3.22]

These clauses are used to implement the PII Principals expectations of privacy, data control, localization and security according to context and notified purpose. These clauses are introduced in contracts, terms and conditions and refer to the concentric notice label controls and requirements as specified in this document Annex X.

These clauses MUST be employed in a manner to scale the expectations of the PII Principal online, to facilitate data governance interoperability and transborder adequacy of electronic consent.

Third Party (or 3rd Party)

A privacy stakeholder other than the personally identifiable information (PII) principal, the PII Controller and the PII processor, and the natural persons who are authorized to process the data under the direct authority of the PII Controller or the PII processor.

[Source: ISO 29100 2.27]

Third party means a natural or legal person, public authority, agency or body other than the Data Subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;

[Source: GDPR Art 4.10]

Third party means a natural or legal person, public authority, agency or body other than the Data Subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;

[Source: Convention 108 Art 3.14]

...

This schema is cumulative, where each schema layer can be added upon the previous layer.

3 Layer ANCR Notice Schema

Layer 1 - Notice Record Schema.

The PII Principal's private record of a notice without digital identifiers, also called a ‘minimum viable record notice’. This record is un-anchored and used for contextual purposes when it does not contain an ANCR Record ID, in the ancr record id field.

Layer 2 – Private Notice Record Micro-Data

1. The meta data that can, and must be collected with the notice record to make a digital record of the notice record

2. Is kept private and not directly accessible, exposed or made public.

3. The PII Principal private record collects personal data specific to the use of the notice

Layer 3 - A Proof of Notice (PoN) record is generated

1. A secured Anchored Notice Record generated upon engagement with a notice to demonstrate that the PII Principal is informed. Not an opt-in or opt-out check box – which is linked to a notice. But check-box to confirm a notice clause is read, with a button on the notice dialogue that generates a record and receipt when used by the PII Principal

2. A proof of notice record can then be used by processing stakeholders to generate subsequent (serialized) linked notice, notification and disclosure records pertinent to the context of notice.

   1. Personal identifiers and attributes are encrypted, secured, verified and validated by linking to the private notice record.

...

These are the schema elements that are used to generate an un-Anchored a static Notice Record and do does not contain any PII, or digital identifiers.

Anchor
_Toc114497460 _Toc114497460

Private Notice Record Profile

These fields can be asserted by the PII Principle to extend the functionality beyond the transparency TPI’s specified, on the PII Principal’s behalf.

These private record fields are separated from the Proof of Notice schema, as these are kept and controlled by the PII Principal and are used to provide defaults.

...

This is the data source for consented records of processing that is directed (and securely) verified by the PII Principal, with secure localized data source and device.

Anchor
_Toc114497462 _Toc114497462

Proof of Notice Record

...

The 2FN produces a network event, presenting information that is needed to produce an evidential record, which a PII Principal can then use independently. A micro-credential used to aggregate operational transparency information, access privacy state and rights information, or to implement personal data controls (that are required for a grant of consent grants to a system to implement controls and permissions in systems for collection, capture, portability and access to private data profiles)

• A notice that is used to generate granular consent receipts using standards that specify purpose in the same way. Those generated with the same schema based can be compared to automate notice for operational transparency over changes to privacy state.

• A 2FN is used to produce a dual record and receipt upon engaging with a standardized notice with access to administrator-level privacy rights from the notice, prior to processing with consent.

• The consent receipts produced from a 2FN can be compared independently to measure the difference in the active state and status of privacy, to automatically produce a notification based on the difference in state.

• Differential Transparency, produced with a tactile signal, or layer1 notice indicator, standardized with machine readable data privacy vocabulary (i.e., concentric and synchronic transparency).

...

In this table, suggestions for what method can be applied on a per attribute level are provided as an example.

1. Blinded Identity Taxonomy (BiT)

   1. PII field security measure that is used to blind attributes that are identifiable, for example, the attributes presented in ISO/IEC 29100 section 4.4.2

   2. A BiT attribute is encrypted with the PII Principals private key- so as not be usable in any data set without the corresponding authority required to unencrypt the field for a specified purpose and treatment.

   3. In this specification BIT is used by the PII Principle to encrypt and blind the ANCR record ID field. Which is in the private notice record, the pseudonymized identifier generated/provided by the PII Principals (client security protocol)

2. Pseudonymized Identifier

   1. The ANCR record id refers to the PII Controller legal identity captured with a notice record, and once a notice record is collected it can be signed to become added to digital wallet (or pod), it can be signed to become a micro-credential, and used to communicate to the PII Controller, to manage rights and control processing of digital identifiers and associated information.

   2. Conceptually, the ANCR Id is a reverse use cookie, in that it is used by the PII Principle to remember the privacy state and track the PII Controller through different service environments, domains and jurisdictions.

3. Verifiable Private Notice Record used in a micro-credential

   1. The PII Principal as the holder of the notice record can use it to a verify the presentation a PII Controller Identity

   2. Holders of a signed notice record (proof of notice) can generate a verifiable presentation of this proof by;

      1. signing a copy of the notice-record (micro-credential)

         1. (transforms record into a micro-credential)

      2. exchanging this with the other stakeholder (PII Principle or Controller) as a signed consent receipt in order to tokenize the exchange of attribute level private record data on a per processing session basis.

         1. (W3C Verified Credential Data Model, www.w3.org/TR/vc-data-model/#what-is-a-verifiable-credential)

4. Differential Transparency – operational transparency signaling

   1. Operational transparency ‘trust’ protocol for comparing the expected privacy state (purpose and credential) each technical session to authorize an instance of processing, whereby a signal is generated only if there has been a change in the expected, and known active state, of privacy.

   2. Differential Transparency (DT) is a contextual transparency enhancing protocol that uses record serialization in order to sequence data control points. Used to maintain a shared understanding of privacy and conversely security expectations.

   3. Implemented by comparing than Anchored Notice Record with a newly minted eConsent receipt. To detect if there has been a change in this expected state. Achieved through self-asserted changes, or through monitoring authoritative public data sources.

   4. DT is used by the PII Principal to automate the verification of trust, monitoring the active state of the PII Controller Legal identity and technical security performance. Prior to authorizing data processing activities by signing a consent notice receipt.

      1. Utilizing the Transparency Performance Indicator’s in the introduction of this specification to transform a consent receipt into a consent token. (Individual authority and providence default controls to implement rights)

   5. Automating Operational Transparency

      1. Human centric notice protocol to keep a record of controllers and context of processing, for each session/interaction, so that these contextual records, controlled owned and secured by the PII Principal, can remember the active state of privacy and verify the PII Control and Privacy state without interrupting the service-user flow.

      2. Notice Signal Layer: For operational transparency at a glance using digital signaling to indicate with concentric labeling what is expected, and what is not.

...

Case Study:: Differential Privacy as a mechanism for Data Control

...

For discussion with security and privacy community. Like digital identity management, how sovereign data control can be measured is by identifying which PII Stakeholder is in control of the personal data and personal data process; who benefits from processing personal data; and how dynamic are the personal data controls? The analysis results indicate which stakeholder can authorise the use of the tool, and for which purpose(s)

...

• Trustworthy identity requires notice and transparency defaults, or else it is very difficult for people trust the use of digital identity technology. As oppose to every jurisdiction and organisation deciding the standard, while services just change their terms and conditions. oppose to every jurisdiction and organisation deciding what is transparent, with T&C’s services just change without notice.

  • The defaults for operational transparency are presented in this industry publication “Adequacy of Identity Governance Transparency” with 23 default transparency for notice, notification and disclosures, which are required for a ZPN code of conduct.⁵

• eConsent is a critical and missing component in the generation of identifiers the use of PII for big-data, machine learning, including differential privacy is arguably a breach of PII and clearly un-ethical as it violates the privacy expectations of the Individual, creating records people don’t control, and can’t see when they are used.

• In this regard, ethical use of differential privacy would require a record of consent to identify and profile and personal identity, then, an explicit consent for the purpose of use.

  • In this way PII Principals can be secure, safeguarded, and empower their choices through the control of who benefits from their personal and why.

• For an anchored notice record, it is recommended that PII Principal identifying information never be included in a record without being secured at the attribute level in the record. When a eConsent receipt is provided, all PII Principal identifiers MUST be blinded except for the legitimate required stakeholders. ,

• Any PII Controller consent records record that combine raw personal identifiers May be more secure for a PII Controller but would insecure and high risk for the PII Principal, those systems are considered in this specification to have non-operational transparency, is not secure enough to be a consent record, which in this specification is self-sovereign anchor record. Trust is understood to be relative to each stakeholder but represented in this specification with a PII Controller consent.

Anchor
_Toc114497468 _Toc114497468

Notice Record Extensions (for a Consent Record information structure)

The Anchored Notice record can be extended with the standardized consent record information structure by using three (3) extensions.

Anchor
_Toc114497469 _Toc114497469

Extension 1: Purpose Specification

The concentric notice label is used to identify the default legal justification for processing which is used for the default data processing practices.

...

The extension is written for the PII Controller, to enable the anchored record to be used as a verifiable data source for operationalizing a channel (exchange) where PII Principals can advertise a consent grant to the controller. (see Appendix 1 )

Anchor
_Toc114497470 _Toc114497470

Extension 2: Data treatment & RIghts based controls

Extension 2 is focused on data treatment and rights of the purpose specified in Extension1. This extension uses some of the ISO/IEC 27560 schema, as well as the W3C Data Privacy Vocabulary, and some additional elements regarding delegation, cross-border adequacy, definition of data privacy rights data controls.

Anchor
_Toc114497471 _Toc114497471

Extension 3:bundled cod of transparency practices

Extending the security code of conduct, purpose specification (Extension 1) and data treatment sections (Extension2) with a transparency code of practice.

...

Anchor
_Toc114497477 _Toc114497477

ANCR Specification Schema Table

Anchor
_Toc114497478 _Toc114497478

ANNEX B: Concentric Notice Label Types

...

These are mapped here to provide a set of operational transparency defaults to set and support privacy as expected by the PII Principal. Expectations that provide a privacy notice starting point, where PII Principal and PII Controller can gain a shared understanding, or where a PII Principal can assert a legal justification for processing to access privacy rights.

Note: Participatory Consensus, and Concentric data control are two outcome specific conditions that will be added to this specification to include an assessment for operational evidence of these two outcomes.

...

Access to privacy rights and information. meaningful through a direct mapping with specific rights, obligations and customs for interaction for data processing, which are enforceable with the references

Anchor
_Toc114497481 _Toc114497481

Appendix — EXTENSIONS

...

Codes of practice can be approved and monitored, and can combine multiple purposes together for an expected code of practice. A “Purpose Bundles” operated with a code practice can be approved and to operationalize privacy.

Anchored Record Schema ‘Structure’

...

In addition to the consent receipt schema, the ANCR record schema provides a protocol for its operation.

...

Anchor
_4f1mdlm _4f1mdlm

Anchor
_Toc498675774 _Toc498675774

Anchor
_Toc108928906 _Toc108928906

Anchor
_Toc114497486 _Toc114497486

Revision history

¹ Lizar, M, Pandit, H, Jesus, V, “Privacy as expected Consent Gateway”, Next Generation Internet (NGI) Grant [Access July 4] http://privacy-as-expected.org/

...

⁴ For example the “Age Appropriate Design Code of Practice,” http://ico.org.uk/for-organisations/guide-to-data-protection/ico-codes-of-practice/age-appropriate-design-code/

⁵ Lizar M, Ortalda, A” “Report on the Adequacy of Identity Governance Transparency – DIACC Special Group Insights” Digital Identity and Authentication Council of Canada [Online]