Page Comparison

• Call to order
• Roll call
• Agenda bashing
• Organization updates

• Meeting was called to order and the roll was called
• Please ensure that you sign the Group Participation Agreement

• Please review these blogs offline for current status on Kantara and all the DG/WG:

  • 2019: May
  • Work + Discussion Group Activity

Motion to ...

Moved by:

Seconded:

Discussion:

Result:

Introductions

All

Welcome!

• Leadership team has decided to write a short current-future-roadmap analysis document around "consent management"
• https://docs.google.com/document/d/1gtD96hH7QpJyVj9n1CYLDfK8HaFHNIo_-COkJ-jPJgw/edit?usp=sharing
• Switched to live edit of the document

2019-04-17 call notes:

• This WG should clarify how "consent" should be considered and represented
  • Is 'consent' a binary relationship? Can it be 'transferred'?
  • It could be any of the above - the idea with the receipt is that it is a person-side record of the event - Kantara can specialize this in any way that is useful
• This WG should look to documented/published policy/rules/regulations produced by specific 'verticals' and interpret those documents
• How should this WG address the topic of 'meaningful consent'?
• Look at: 
• https://www.healthit.gov/topic/meaningful-consent-overview
  
• https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_omc_201805/
• https://iapp.org/news/a/opc-releases-guidelines-on-meaningful-consent/
• https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_omc_201805/

How do we incorporate meaningfulconsent.org from Southampton University?

Look into submitting papers to:

SOUPS conference:

https://www.usenix.org/conference/soups2019

August 11–13, 2019, at the Hyatt Regency Santa Clara in Santa Clara, CA, USA

PEPR'19

2019 USENIX Conference on Privacy Engineering Practice and Respect

https://www.usenix.org/conference/pepr19

AUGUST 12–13, 2019 SANTA CLARA, CA USA

• Discussion about pressure points and the demand for 'consent'
  • Discussion on seeing 'consent' requirements in some RFPs - purchasing 
  • Also -  Service providers (data processors) are starting to insist that Brands (the data controllers) have valid 1st party consent from consumers (data controller to data processor demands) 
• ACH asked Marco for ratio of wants consent stuff versus not asking for consent stuff in rfps
• ACH asked Marco for sample language - examples of how company RFPs ask for consent management-related stuff
• Andrew speculates - what if CMS WG produced a boilerplate clause setting out how to ask for consent management stuff?
• James - one aspect is when a customer 'signs up' with a provider - explicit; another aspect is passive tracking; this is the omnichannel user consent management problem - the person might set different instructuctions on every different channel the customer connects to the provider (e.g. in person vs mobile app)
  • Caution to ourselves that user preferences can come from any channel, not just 'web' or 'mobile app'
• Lisa & Eve Maler have written a paper that sets out 'consent' needs to evolve - interesting supporting material
• James - identification of the user is a challenge that intersects with the explicit/active consent management topic
  • This is a big challenge for companies
  • Companies are seeking a solution to lightweight but robust identification solutions - rather than asking for an emailed picture of a passport or ID card
    • There is a need for safe, secure solutions to linking customer interaction channel identifiers together in order to manage consent instructions at a **person** level, not at a channel-user level
  • Notes that collection of passive identifiers via setting a cookies etc is problematic when those passive identifiers are sent onwards to a third party that has the capability of linking those passive identifiers to actual individuals. If the identifiers cannot be linked to real persons (because they are not sent onwards) then they are less problematic.
  • Companies want risk mitigation - this can mean unification of the many 'consents' that a person gives to a company due to many channels

Events that Kantara will have an active role: https://kantarainitiative.org/events/

ACTIONS:

:

Next WG meeting Wednesday, May 15XXXXXXXX, 2019 10:00 Eastern Daylight Time / 14:00 GMT