ANCR Consent Token: Mirrored Record Information Structure v0.7
Consent Receipt V1.1 work can be found here

Version: 0.7

Document Date: Dec 6, 2023

...

Status: WG Draft v0.7 (updated from Sept 2022-Archive-Next version Feb-March 2024)

Editor Note

A Record of processing provides transparency over who is accountable and is a pre-condition for processing PII with scalable governance and security. Operational transparency , with mirrored records of processing requires that the identity of the controller, the legal justification, governance framework and jurisdiction be presented prior to data processing. The AuthC Protocol utilises this mirrored record and receipt standard record information structure, now standardized in tprocessing scales human context and understanding into systems. Transparency over data control ensures a consent by default methodology enabling individuals to regulate surveillance. Brining together two very mature regulatory instruments, standard for records, and compliance for receipts, with a new technical standard of digital credentials.

...

Anchor
_30j0zll _30j0zll

Anchor
_Toc815404337 _Toc815404337

Anchor
_Toc108928868 _Toc108928868

Preface

Public international laws and standards for digital record and receipts promise to dramatically lower the cost of security and increase the effectiveness of privacy. The use of ISO 29100 security and privacy framework for consented data access, control and transfer adequacy proposes a low cost, or free notice record framework for PII Principles (and Controllers). To facilitate the governance and regulation by all privacy stakeholders, by regulating authorities.

The Legal Rules Codified

In this framework, the privacy, notice and consent, transparency code of conduct is the law that is developed into open source code, and required to access un-linked data silo’s, across jurisdictional and technically -networked disparate systems.

   digital privacy transparency with

[Anonymous] Consent by Default: the common mode of governance

• Digital Consent is required by default, an individual is notified if PII is needed, for what purpose, and what permissions are required.

...

§  Interaction with this transparency gateway, is what is recorded, and what is provided to the individual as a knowledge receipt

Purpose Defined

6 Legal Categories of Authority

Consent

Contract

Public Interest

Best Interest

Legal Obligation

Legitimate Interest

Types of Consent

a.     Types of Consent

Expressed

Implicit

Explicit

Directed

Altruistic

Concentric Notice Labels

It is very difficult for stakeholders to know what law, rules and obligations apply in any given context, to address this, Concentric Notice Labels map the legal justification, and the type of consent to rights, and digital rights controls that reduce liability and mitigate risks.

Anchor
_Toc498675767 _Toc498675767

Anchor
_Toc108928897 _Toc108928897

Anchor
_Toc756684090 _Toc756684090

ANCR Record

An ANCR Record, is the initial digital identity rep relationship record in a linked chain of records, in which a record of a processing activity captures a; notice, notification or disclosure, in a standard record, using data privacy vocabulary. The record is a snapshot of the state of digital privacy transparency provided by a PII Controller, or a PII Controller’s delegate processor.

The notice record is first specified as a static, one-time use notice record that is created by the PII Principal and used to initiate a state of operational transparency in context measured by access to, and performance of rights.

Anchor
_Toc2008526199 _Toc2008526199

Table1: Single Use Notice Record: PII Controller Identity & Contact Transparency Report

Anchor
_Toc2104346831 _Toc2104346831

Anchoring the Notice Record for Trust

Without a record identifier, added to each record, this initial record is un-anchored notice record. This record can be extended for use as a Trust Anchor for the PII Principal by adding an ANCR Record ID used to track the PII Controller and the data processing relationship over time.

As a trust anchor, it becomes a record the individual can use to verify the digital identity relationship to secure a privacy context in a system.

Anchor
_Toc108928874 _Toc108928874

Anchor
_Toc498675757 _Toc498675757

Anchor
_Toc959348517 _Toc959348517

Notice Record References

For the purposes of this specification, the following terms and definitions apply as, normative, non-normative to be used per context, and additive, in that they aid human understanding and data control.

...

— IEC Electropedia: available at http://www.electropedia.org/

Anchor
_Toc624870929 _Toc624870929

Normative References

For the international and cross-domain use of the records and receipts here, this document refers to the following:

• ISO/IEC 29100:2011 Security and privacy techniques

• ISO/IEC 29184 Online privacy notices and consent,

• Fair Information Practice Principles (FTC) foundational principles

Anchor
_Toc1499868010 _Toc1499868010

Non-Normative References

1980/2013 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data [OECD]

Kantara Initiative Consent Receipt v1.1

Anchor
_Toc2008269942 _Toc2008269942

Additive Reference

• General Data Protection Regulation (GDPR)

• Council of Europe Convention 108+ (Conv. 108+)

  • PIPEDA – Individual, Meaningful Consent,

Anchor
_Toc552851266 _Toc552851266

Notations and Abbreviations

The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", “NOT RECOMMENDED”, "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC 2119].

The following abbreviations and set of stakeholders are used to frame a mutually exclusive and collectively exhaustive set of terms for providing transparency over what organization controls the processing of perosnal information, and who is accountable for enforcement,

...

Array – an array of field objects

Anchor
_Toc521066688 _Toc521066688

Terms and definitions

The definitions reference terms that are used in this specification to indicates what is normative, non-normative, and additive.

If a jurisdiction’s privacy terms are not compatible with this specification, these internationally defined terms can be mapped to jurisdiction and context specific terms. For example, PII Principal in this document maps to the term Data Subject in European GDPR legislation and the term individual in Canadian PIPEDA.

Anchor
_Toc1004157259 _Toc1004157259

Concentric Notice Types

For Individual participation and access

...

[Source Conv 108+ Rec.20]

Anchor
_Toc1951581593 _Toc1951581593

Notice

Adhering to the openness, transparency and notice principle means:

...

Broadly refers to any surveillance or privacy notice, notification, disclosure, statement, policy, sign or signal used to indicate personal data processing.

[ANCR Notice Record ]

Anchor
_Toc153448219 _Toc153448219

Notice Modalities

The organization may implement the control using different techniques: layered notices, dashboards, just-in-time notices and icons, and may provide notices in a machine-readable format so that the software which is presenting it to the PII principal can parse it to optimize the user interface and help PII principals make decisions.

...

That information may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner, a meaningful overview of the intended processing. Where the icons are presented electronically, they should be machine-readable.

[Conv 108+ Rec 35]

Anchor
_Toc1832292683 _Toc1832292683

Notice Record

When organizations should seek consent for changes such as those outlined here, they should consider whether the PII principal has access to a record (of some kind) of their original consent, as well as how much time has elapsed between the original consent and the present. If the PII principal is able to access a record of their prior consent readily and if the elapsed time is not significant, organizations may provide notice of the changes and seek consent for same. Otherwise, the organization should seek reconfirmation of the original consent in addition to consent to the notified changes.

...

[Source: ISO/IEC 29100 Table 3]

Anchor
_Toc438824126 _Toc438824126

Proof of Notice

Providing a record of notice

1. 1. [Source ISO/IEC 29184

Anchor
_z337ya _z337ya

Anchor
_Toc108928885 _Toc108928885

Anchor
_Toc498545136 _Toc498545136

Personally Identifiable Information (PII)

Any information that (a) can be used to identify the PII Principal to whom such information relates, or (b) is or might be directly or indirectly linked to a PII Principal.

...

(‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

(Source: Con. 108+)

Anchor
_3j2qqm3 _3j2qqm3

Anchor
_Toc108928886 _Toc108928886

Anchor
_Toc1951361816 _Toc1951361816

PII Principal, Data Subject or (Individual)

The natural person to whom the personally identifiable information (PII) relates.

...

Individual

[Additive: PIPEDA]

Anchor
_1y810tw _1y810tw

Anchor
_Toc108928887 _Toc108928887

Anchor
_Toc2071785810 _Toc2071785810

PII Controller

A privacy stakeholder (or privacy stakeholders) that determines the purposes and means for processing personally identifiable information (PII) other than natural persons who use data for personal purposes.

...

Note: it may also be called data controller.

Anchor
_4i7ojhp _4i7ojhp

Anchor
_Toc108928888 _Toc108928888

Anchor
_Toc730670413 _Toc730670413

PII Joint Controller

Covers multiple joint controller relationships including co-controllers, hierarchical, fiducial, and code. Likely a type.

Anchor
_2xcytpi _2xcytpi

Anchor
_Toc108928889 _Toc108928889

Anchor
_Toc356138764 _Toc356138764

PII Processor

A privacy stakeholder that processes personally identifiable information (PII) on behalf of and in accordance with the instructions of a PII controller.

[SOURCE: ISO 29100]

Anchor
_1ci93xb _1ci93xb

Anchor
_Toc108928890 _Toc108928890

Anchor
_Toc2127985996 _Toc2127985996

PII Sub-Processor

An additional field to indicate a delegated processor.

Anchor
_3whwml4 _3whwml4

Anchor
_Toc108928891 _Toc108928891

Anchor
_Toc1112563695 _Toc1112563695

Processing of PII

An operation or set of operations performed on personally identifiable information (PII).

...

[Source. Convention 108+]

Anchor
_2bn6wsx _2bn6wsx

Anchor
_Toc108928892 _Toc108928892

Anchor
_Toc2075980450 _Toc2075980450

Privacy Stakeholder

A natural or legal person, public authority, agency or any other body that can affect, be affected by, or perceive themselves to be affected by a decision or activity related to personally identifiable information (PII) processing.

[SOURCE: ISO 29100]

[GDPR

[Conv

Anchor
_qsh70q _qsh70q

Anchor
_Toc108928893 _Toc108928893

Anchor
_Toc1178936335 _Toc1178936335

Security

[Source: ISO/IEC 29100: Annex A]

Anchor
_Toc312554877 _Toc312554877

Third Party

A privacy stakeholder other than the personally identifiable information (PII) principal, the PII controller and the PII processor, and the natural persons who are authorized to process the data under the direct authority of the PII controller or the PII processor.

...

[Source: Convention 108 Art 3.14]

Anchor
_Toc1080768447 _Toc1080768447

Notice Record Information Structure

The ANCR Record is essentially a layered record schema, the first record is the minimum viable consent receipt record, This record collects no additional data, except what the PII Principal would require to see in order to initiate electronic notice and consent dialogue with some operational security assurance.

...

Note: ANCR Notice record ID is utilized to create and link new receipts ensuring the providence of the PII Principals control of the ANCR record

Anchor
_Toc1396619427 _Toc1396619427

Notice Record Schema: PII Controller Identity & Privacy Contact Point Schema

This is the schema elements that are used to generate a un-anchored notice record and do not contain any PII, or digital identifiers.

...

Anchor
_Toc1475437488 _Toc1475437488

Proof of Notice Record Schema

A consent receipt, when provisioned with is Proof of Notice record, builds on the PII Controller Identity and Contact field base to generate a proof of notice record with PII fields to a corresponding private proof of notice record.

This legally required information for proof of notice. This event information is needed for legal chain of evidence, in which PII is added to the record but blinded, and secure. Starting with the Private ANCR Record ID which the PII Principal can use to aggregate operational transparency information for more advanced use in context.

Anchor
_Toc1217379690 _Toc1217379690

Private Notice Record Schema

These fields can be asserted by the PII Principle to extend the functionality beyond the transparency KPI’s specified.

...

Anchor
_Toc498675771 _Toc498675771

Anchor
_Toc108928904 _Toc108928904

Anchor
_Toc878728950 _Toc878728950

Notice Record Security

Notice Record is first a tool of transparency, a private record with this minimal purpose. It is then extended into two records, 1. being a private proof of notice record proof of notice record, which provides assurance that the PII Principal has read the notice. Impl

...

The KPIs provide transparency and security assurance to qualify the PII Controller before the controller processes personal information.

Anchor
_Toc687541636 _Toc687541636

Conclusion –

Anchor
_Toc1484248266 _Toc1484248266

Towards Privacy

PII Principal identifying information MUST never be included in this specified ANCR Record. When a consent receipt is provided, all PII Principal identifiers MUST be either blinded or pseudonymized, e.g., with a verifiable credential using zero-knowledge proof. Any PII Controller consent records that combine raw personal identifiers with a consent record are therefore insecure and those systems are considered non-operational and insecure.

This categorizes most of the current internet and identity infrastructure as non-operational from a security perspective. As a result nearly all digital identifiers in an identifier management relationship produce raw PII for all parties that require security considerations. Access and use of this record as a data source in these cases are achieved through extensions. Annex A

Anchor
_Toc493268152 _Toc493268152

Notice Record Extensions

Anchor
_Toc771236585 _Toc771236585

Extension 1

ISO/IEC 27560 is used to generate a standard purpose-based notice and consent information and identifier structure. This is utilized by the ANCR Record schema and protocol to specify or audit a purpose for any legal justification.

The extension is written for the PII Controller, to enable the anchored record to be used as a verifiable data source for operationalizing a channel (exchange) where PII Principals can advertise a consent grant to the controller. (see Annex C)

Anchor
_Toc1964662622 _Toc1964662622

Extension 2

Once specified, the W3C Data Privacy Vocabulary is used to specify the treatment of personal data.

Anchor
_Toc120345008 _Toc120345008

Extension 3

Extending the ANCR Notice record, purpose specification and data treatment sections with a code of conduct (transparency practices) specified by industry, trade associations and civil registries (referred to as code of conduct as it references the legal requirements).

...

[Note: The appendices introduce the new elements found in this specification, as well as a schema map for interoperability with ISO/IEC 27560 for contribution.]

Anchor
_Toc831205195 _Toc831205195

Acknowledgements

• Kantara Community, DIACC, ToiP, W3C DPV and Consent,

• The ISO/IEC 27560 committee

• Standards Council of Canada

• PasE; Consent Gateway Team and the NGI – Next Generation Internet Grant contribution

Anchor
_1v1yuxt _1v1yuxt

Anchor
_Toc498675772 _Toc498675772

Anchor
_Toc108928905 _Toc108928905

Anchor
_Toc1716347183 _Toc1716347183

References

[Conv 108+] Council of Europe, Convention 108 +

...

[OECD]OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. http://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.htm

Annex (WiP to v8.9.9)

Anchor
_Toc446483100 _Toc446483100

ANNEX A : ANCR OPERATIONAL SCHEMA

ANCR Record, with these annex show the human centric transparency ontology, This annex focuses on the data technical semantics of the ontology from a Human (label), for legal reference, to a machine readable attribute, for an operational transparency schema.

...

• Text: a data type that defines a human-readable sequence of characters and the words they form, subsequently encoded into computer-readable formats such as ASCII.

• Numeric: a data type that defines anything of, relating to, or containing numbers. The numbering system consists of ten different digits: 0, 1, 2, 3, 4, 5, 6, 7, 8,and 9.

• Reference: a data type that defines a self-addressing identifier (SAID) that references a set of attributes through its associated parent. SAID is an identifier that is deterministically generated from and embedded in the content it identifies, making it and its data mutually tamper-evident.

• Boolean:a data type where the data only has two possible variables: true or false. In computer science, Boolean is an identification classifier for working out logical truth values and algebraic variables.

• Binary:a data type that defines a binary code signal, a series of electrical pulses representing numbers, characters, and performed operations. Based on a binary number system, each digit position represents a power of two (e.g., 4, 8, 16, etc.). In binary code, a set of four binary digits or bits represents each decimal number (0 to 9). Each digit only has two possible states: off and on (usually symbolised by 0 and 1). Combining basic Boolean algebraic operations on binary numbers makes it possible to represent each of the four fundamental arithmetic operations of addition, subtraction, multiplication, and division.

• DateTime: a data type that defines the number of seconds or clock ticks that have elapsed since the defined epoch for that computer or platform. Common formats (see 'Format Overlay') include dates (e.g., YYYY-MM-DD), times (e.g., hh:mm:ss), dates and times concatenated (e.g., YYYY-MM-DDThh:mm:ss.sss+zz:zz), and durations (e.g., PnYnMnD).

• Array [attribute type]: a data type that defines a structure that holds several data items or elements of the same data type. When you want to store many pieces of data that are related and have the same data type, it is often better to use an array instead of many separate variables (e.g. array[text], array[numeric], etc.).

Anchor
_Toc869135868 _Toc869135868

ANNEX B

Anchor
_Toc716553674 _Toc716553674

Two Factor Notice (for differential transparency)

• A notice that is used to generate granular consent receipts using standards that specify purpose in the same way. Those generated with the same schema based can be compared to automate notice for operational transparency over changes to privacy state.

• A 2fN, is used to produce a dual record an receipt upon engaging with a standardized notice with access to admin privacy rights from the notice, prior to processing with consent.

• The consent receipts produced from a 2fN, can be compared independently for difference in the state and status of privacy, to automatically produce a notification based on the difference in state.

• Differential Transparency, produced with a tactile signal, or layer 1 notice indicator, standardized with machine readable data privacy vocabulary. (concentric and synchronic transparency)

Anchor
_Toc1127471363 _Toc1127471363

ANNEX B

Anchor
_Toc1899188690 _Toc1899188690

Concentric Notice Types

The object of the ANCR record is to enable operational transparency. A concentric notice type is used to provide a human centric label to a record or a receipt.

...

. Referencing the corresponding ISO/IEC 29184 control to enhance interoperability of operational transparency. Interoperability that is realized through the extension of transparency with records of processing to establish and maintain a shared understanding of security and privacy risks. Affording people choice which mitigate risks and transfer liability.

Anchor
_Toc740624698 _Toc740624698

Mapping Legal Justifications to Concentric Notice Types

These are mapped here