Use Case: Kantara v0.8 Implementation
Authors: Mark & Oliver
Log Of Activities
| Activities | Date | Status | Notes |
|---|---|---|---|
| Converted Api to Plugin | Finished | ||
| Updating JSON to v0.8 | 16/Jun/2016 | in progress | |
| Adding 2 conformance modes to this doc |
Brief Description
A part of enrolment to engage in this workgroup is to agree to the general participation agreement, consent to the IPR Conditions, choose voting status, and self assert the authority to represent your company.
(Note: This is a continuation of the Consent & Information Sharing WG reference implementation, updating to v0.8 draft of the Consent Receipt specification.
...
https://kantarainitiative.org/beta-signup/
In this use case; Work Group - General Participation Agreement and Kantara Work Group enrolment
- Assessment Kantara Consent Policy Notice and Disclosure Assessment
- Review Purpose of Consent collection in the General Participation Agreement
- Scope of Consent for PII use, disclosure and collection
- Design of Receipt - (completed once comments and UX considerations created (see ISO SC/JT Input)
1. Assessment
Kantara has a trusted and unique brand in trusted services, in that it is a community of people invested in standards development, developing trusted technology, policy, protocols around identity and policy. As a result, it is important to Kantara to be transparent around the collection use and disclosure of PII as Kantara Initiative is comprised of open and transparent Work Groups, where members agree to participate in a WG by consenting to a workgroup participation agreement.
To create a consent receipt the privacy policy (or existing consent notice) was reviewed for collection, use and disclosure practices, and these were collected in order to implemenet a base consent receipt template for the Kantara WG GPA sign-up form.
Review recommendations:
- In the privacy policy there is a reference to an implied consent to transfer personal information across jurisdictional borders which is not compliant with current Privacy Shield practices
- Recommend adding an explicit consent to the WPA form
- Member data shared on WG WIKI in participation roster (link to participant roster)
- All post to mailing list are captured in a public achieved (link to mailing list for m)
WG PII Disclosure
- Disclosure
- Virtual
- Emma Inc
In the current CISWG Participation Agreement sign up form there are 4 active options.
...
Actors
Individual a New Member: An interested new member would fill out this enrolment form
Kantara CIS-WG: the workgroup that is working on a project.
Stakeholders
- Kantara Initiative & Community
Pre Conditions (Mode 1)
- Assessment for the Collection of Consent Notice Information
- privacy policy link
- DC Identity and Contact
- list of use, collection and disclosure based on purpose of use
- create a link to update PII, withdraw consent, or change status of consent
- Individual Providing PII to become a member must
- Consent to Join WG
- Self Assert Authority to consent on behalf of organisation (requires link to withdraw authority)
- Consent Preference (secondary purpose) - voting or non-voting (link to policy for changing voting status)
- Consent to the Kantara PII Disclosure (list disclosure)
Post Conditions (Mode 2)
- Create a Consent Receipt in JSON conforming the the data dictionary
- consent receipt with a link to all the relevant consent notices
- Consent Receipt Provisioned at point of consent once
Basic Flow: See CR-Use Case Basic Site Registration