...
This work has, from time to time, been managed as a "subgroup" of the overall Work Group. The overall goal of the work is accelerate adoption and reduce inhibitors in a business context. We published a draft Report in February 2018 (nicknamed "UMA Business Model") called A Proposed Licensing Model for User-Managed Access (or, "How the UMA protocol enables a license-based model for controlling access rights to personal digital assets"). You can retrieve it from the Kantara Initiative Reports and Recommendations page. This report is intended for professionals in the areas of law, privacy, risk, compliance, security policy, and business policy, particularly those responsible for building and running UMA-enabled services. Much of our current work can be seen in our UMA Legal role definitions slide deck (you will need to request access)Please visit our Legal Subgroup Notes page for more detail and links.
What is the purpose of the UMA business/legal framework? The UMA technical protocol enables individuals to apply protection policies to their digital assets by using services to issue various kinds of "permission tokens". The UMA business/legal framework above the protocol maps those permission tokens and related artifacts to licenses as legal devices. This licensing mechanism is valuable to individuals, organizations, legal professionals, and privacy professionals because it allows "Alice" to license "Bob" to use her digital resources on her terms.
We previously set out some specific goals of the business-legal framework effort:
- Produce a set of toolkits and associated educational materials whose purpose is to accelerate the ability of those in the following roles to adopt, deploy, and use UMA-enabled services in a manner consistent with protecting privacy rights:
- Individuals ("natural persons")
- Organizations ("legal persons" such as businesses and governments)
- Legal representatives of the above
- Focus on GDPR-related toolkits first. A toolkit could be anything that helps use or leverage an existing piece of legislation or framework, such as an SDK, a checklist, consent receipt templates or profiles, or a set of CommonAccord text, and could be related to the GDPR itself, the EU-U.S. Privacy Shield, BCRs, and so on.
- To inform the roadmap work, develop:
- Comparative analysis of UMA and GDPR concepts such as data subject, processor, and controller
- Roundup of contractual and regulatory use cases
- Leverage specialist legal expertise wherever possible to complete and review the deliverables
...
History
This slide deck, presented at Digital Contracts, Identities, and Blockchain at MIT in May 2016, shares shared some key early use cases (see slide 26+). A few additional artifacts are available on the WG's GitHub wiki. All of this work predates the analysis being performed.
The subgroup found funding to work with legal expert (now UMA WG Legal Editor) Tim Reiniger starting in 2017, with a schedule to produce three staged deliverables. The first, Use Cases for Analyzing and Determining a Legal Framework, was delivered in draft on 28 Feb 2017, with the group providing commentary and revisions as input to later stages, resulting in a revised final version delivered 26 Mar 2017. The second, The Legal Value Perspective for UMA Use Cases, was delivered on 31 May 2017, again after extensive group review and commentary. The third, UMA Definitions Annotated, was delivered 25 Aug 2017. A broader "legal framework" (now called business model), incorporating a revised version of the definitions, was published in early 2018. The model text work has previously been encoded in draft form in the CommonAccord.org system. CommonAccord is: "...an initiative to create global codes of legal transacting by codifying and automating legal documents, including contracts, permits, organizational documents, and consents. We anticipate that there will be codes for each jurisdiction, in each language. For international dealings and coordination, there will be at least one "global" code." The subgroup's past meeting times and notes are here. Legal topics are currently being covered in the main Work Group call series. See the UMA home page, UMA calendar, and main Meetings and Minutes page for details.
...