Parts 1 and 2 for measuring conformance, compliance, and performance of Dynamic of Transparency and Consent

Anchor
_Toc155867426 _Toc155867426

Conformity & Compliance

...

Scheme Framework v0.9.3.8

ANCR refers to an Anchored Notice & Consent Receipt, it is a record that is generated using the Transparency Performance Indicator assessment, which provides a standard measure of operational performance of the present PII Controller’s security and privacy session information.

...

This specification relies on (open access to) ISO/IEC 29100 Security techniques, Privacy framework and ISO/IEC 29184 online privacy notices and consent, and the Consent Notice Receipt in the Appendix B, further specified by ANCR Mirrored Record Information Structure,³ Consent Notice Receipt Format as specified in the Kantara Initiative ANCR WG Mirrored Record information structure, extending the CISWG MVCR and Consent Receipt v1.1.⁴

Anchor
_Toc155867428 _Toc155867428

Conditions for use

License Condition:

This document has been prepared by participants of Kantara Initiative Inc. ANCR-WG. No rights are granted to prepare derivative works of this Scheme outside of the ANCR WG. Entities seeking permission to reproduce this document, in whole or in part, for other uses must contact the Kantara Initiative to determine whether an appropriate license for such use is available.

...

Part 1 of the scheme introduces 4 Transparency Performance Indicators; these are used to measure and rate the conformance of transparency.  In Part 2 of the scheme (in the Appendix A) a transparency information request is sent to the controller to; a) test the controller information and, b) measure how compliant the performance of digital transparency is, to both legal expectations, and the personal privacy expectations of the PII Principal.   

Anchor
_Toc155867432 _Toc155867432

Terms & Definitions

ISO/IEC 29100 is also normative, this security and privacy framework standard maps terms in the standard itself, for example PII Principal is mapped to the Data Subject.

...

4 TPI’s

The 4 Transparency Performance Indicators capture transparency and data capture practices in context and are used to test the self-asserted information for its operational usability.

...

This is a 1.0 document; we look forward to its evolution.

Anchor
_Toc155867448 _Toc155867448

TPI Compliance Assessment Scheme Part 2

Anchor
_Toc155867449 _Toc155867449

Operational Transparency Assessment

The following describes an assessment using the TPIs to measure Operational Transparency and assurance.

...

1. Transparency is required to be available in context, i.e., during the time when PII is obtained (found in Transparency Statement or Privacy Policy).⁸

   1. Time period data stored.

   2. Existence of rights/controls to access and rectify.

   3. Existence of right to manage consent.

   4. Existence of right to lodge a complaint with a Data Protection Authority (DPA).

   5. Whether processing is based under a statutory, or contractual context, or whether necessary for entering a contract, if the PII is obliged, and the consequences of failure to provide this data.⁹

   6. Existence of

      1. AI, or any automated decision-making technology

      2. Digital identity management surveillance technologies

      3. Any profiles, or graphs generated

      4. Meaningful information about the logic involved

         1. Significance in overall policy or processing and decision making

         2. Expected consequences for and to PII Principal - Data Subject

Anchor
_Toc155867450 _Toc155867450

TPI Assessment Guidance

The TPI Rating system is designed to measure the operational performance of the information, for example if only a mailing address is provided for a privacy contact on a website, this is considered non-operable according to the context. This means that privacy access and specific information is not retrievable in the context of data collection. The TPIs measure adequacy and demonstrate non-performance by PII Controllers as a form of data co-governance.

The associated Conformity Assessment: uses the open ISO/IEC 29100 security framework for generating interoperable records and receipts of data processing activity, according to transparency in context.

Anchor
_Toc155867451 _Toc155867451

TPIs are captured in sequence

a. TPI 1 measuring the point when the individual is notified versus when personal information/digital identifiers are collected and processed. The scheme starts by capturing the timing of notice presentation in relation to first data capture, and first contact.¹⁰

...

Combined, these TPIs provide an overall Indication of the operational state of digital privacy.

Anchor
_Toc155867452 _Toc155867452

TPI – Scheme 1, Part 1(S1-P1) metric logic

Anchor
_Toc155867453 _Toc155867453

1.2.    Table 2: ANCR Mirrored Record Schema Example

This appendix is an example of a notice record and the schema and can be used as a template for the information record, rating, and analysis.

...

Anchor
_Toc155867454 _Toc155867454

Digital Transparency Code of Conduct

These digital transparency code of conduct rules coincide with the TPIs presented and reference the international adequacy requirements for transparency required for digital identifier management. In Report on the Adequacy of Digital Identity Governance for cross border transparency and consent:

...

1. Provide their PII Controller Notice Credentials, before or at the time of processing personal information (TPI 1), Article 14.1

2. PII Controller credential information must be accessible

3. PII Controller credential information must be operationally capable for access to rights with evidence of notice & consent

4. The security context must match the controller’s jurisdiction where it is assumed PII is processed

Anchor
_Toc155867455 _Toc155867455

Appendix D. References

Council of Europe 108+

Anchor
_Toc155867456 _Toc155867456

Appendix F. ISO scheme Profile

...

³ Mirrored Record Information Structure, 2024, ANCR WG Kantara Initiative { ANCR: Mirrored Record : Consent Receipt V2: Consent Token Information Structure v0.7 }

⁴ Consent receipt v1, CISWG Kantara Initiative https://kantarainitiative.org/download/7902/

...