UMA Legal

You can find a description of the overall User-Managed Access proposition here: http://tinyurl.com/umafaq.

Part of the UMA WG's work is overtly technical, and part of the work explores other layers of the BLT (business-legal-technical) sandwich. The documents here reflect work in these other areas, many produced by our ad hoc "legal subgroup".

This work has, from time to time, been managed as a "subgroup" of the overall Work Group. The overall goal of the subgroup: Accelerate work is accelerate adoption and reduce inhibitors in a business context.

Mission

The animating mission of the legal subgroup guiding us in 2015:

Develop recommendations about resource owner-and-requesting party [Alice-and-Bob], resource server-and-authorization server [service-and-hub], and any other transactional relationships in the UMA environment, keeping in mind international jurisdictional friendliness; applicability to many different vertical and horizontal use cases, including health; and support of higher-level access federation trust frameworks and similar efforts.

The sharpened mission particulars guiding us 2016:

Focus on:

• Drafting model text (the term and abbreviation definitions and the model clauses)
• Gathering requirements for the environment for using the model text 
• Being guinea pigs for the environment

Target Q1 for external beta review of the model text. "Accordion" the environment requirements to account for budgetary uncertainty.

Update August 2016: We have made some progress on the model text, but it has turned out to be important to work on an auxiliary deliverable, a primer called UMA in Contractual and Regulatory Contexts, that maps the relationships of concepts at the technical, contractual, and regulatory levels. Expect more progress in coming months!

Subgroup meetings

The subgroup's meeting times and notes are here. We meet on Fridays at 8am PT.

If you are just visiting and are interested to join the UMA Work Group and take part in this subgroup's efforts, we invite you to join! Visit our home page and see the Join link there. Note: Since the legal subgroup meetings do not count towards WG quorum, it's advised to join as a "non-voting participant" unless you also intend to join the WG meetings on Thursdays at 9am PT.

Sources of liability tension

These are some key trust relationships we are exploring for the "liability tensions" within them, that is, the misalignment of incentives that leads to a reluctance to deal with each other, mistrust, or added friction in decisions to use or deploy UMA. Here are some of our use cases?

• When Alice sets up criteria for access to a digital data resource of hers, such as "Only Bob can access this", can she ensure that the other actors in the authorization chain are doing their best to make sure Bob "is who he says he is" by the time he (someone) actually gets access?
• If Alice wants to impose limitations on how Bob uses her stuff using business-legal methods vs. some kind of (say) encryption or DRM methods, such as "Bob must promise not to share this data with third parties", how can she ensure these limitations stand up?
• Can the host of some sensitive information of Alice's, such as personal data, trust an authorization service that promises to do the job of protecting that information in an outsourced fashion? This is roughly akin to the challenges of federated authentication, only for authorization.
• Can Alice trust an authorization service to do as she bids when it comes to protecting her stuff, if she didn't personally hand-code it?
• Can an authorization service rely on the hosts of Alice's data and the client applications that Bob uses to operate correctly in their UMA roles?
• Can the host of Alice's data ensure that it can keep out of legal trouble even if Alice's authorization service appears to want it to share data with a recipient who is in a jurisdiction to which personal data is not allowed to be sent?

Model text

The model text work is being encoded We published a draft Report in February 2018 (nicknamed "UMA Business Model") called A Proposed Licensing Model for User-Managed Access (or, "How the UMA protocol enables a license-based model for controlling access rights to personal digital assets"). You can retrieve it from the Kantara Initiative Reports and Recommendations page. This report is intended for professionals in the areas of law, privacy, risk, compliance, security policy, and business policy, particularly those responsible for building and running UMA-enabled services. Please visit our Legal Subgroup Notes page for more detail and links.

What is the purpose of the UMA business/legal framework? The UMA technical protocol enables individuals to apply protection policies to their digital assets by using services to issue various kinds of "permission tokens". The UMA business/legal framework above the protocol maps those permission tokens and related artifacts to licenses as legal devices. This licensing mechanism is valuable to individuals, organizations, legal professionals, and privacy professionals because it allows "Alice" to license "Bob" to use her digital resources on her terms.

History

This slide deck, presented at Digital Contracts, Identities, and Blockchain at MIT in May 2016, shared some key early use cases (slide 26+). A few additional artifacts are available on the WG's GitHub wiki. All of this work predates the analysis being performed.

The subgroup found funding to work with legal expert (now UMA WG Legal Editor) Tim Reiniger starting in 2017, with a schedule to produce three staged deliverables. The first, Use Cases for Analyzing and Determining a Legal Framework, was delivered in draft on 28 Feb 2017, with the group providing commentary and revisions as input to later stages, resulting in a revised final version delivered 26 Mar 2017. The second, The Legal Value Perspective for UMA Use Cases, was delivered on 31 May 2017, again after extensive group review and commentary. The third, UMA Definitions Annotated, was delivered 25 Aug 2017. A broader "legal framework" (now called business model), incorporating a revised version of the definitions, was published in early 2018. The model text work has previously been encoded in draft form in the CommonAccord.org system. CommonAccord is: "...an initiative to create global codes of legal transacting by codifying and automating legal documents, including contracts, permits, organizational documents, and consents. We anticipate that there will be codes for each jurisdiction, in each language. For international dealings and coordination, there will be at least one "global" code."

Here is the draft model text. Only the definitions have been worked on as of 1 April 2016. It helps to know how to navigate CommonAccord text: First, click on 0.md to get the current full text, and the "Document" link to expand the Source view into a proper document.

Additional artifacts

A few additional artifacts are available on the WG's GitHub wiki. Also see this presentation from the MIT event Digital Contracts, Identities, and Blockchain The subgroup's past meeting times and notes are here. Legal topics are currently being covered in the main Work Group call series. See the UMA home page, UMA calendar, and main Meetings and Minutes page for details.

Just visiting? We invite you to join the Work Group! Visit our home page and see the Join link there.