CC

Consent & Choice

• If consent is not the basis for processing mobile credential data, the authority must be made clear before release.

•  

PL

Purpose legitimacy and specification

CL

Collection Limitation

DM

Data Minimization

UR

Use, retention, and disclosure limitation

• Can’t phone home

? Terminal Authentication - Issuer issues a policy

AQ

Accuracy & Quality

• Minimum accuracy to fulfill the purpose of the transaction

• Minimum tracking

  • Location

  • Longitudinal

•  

OT

Openness, transparency, and access

• Ability to see and correct data

IA

Individual access & participation

Mobile Credentials must be made available to all subjects that have right granted by Issuer

Verifiers must accept credential

Issuers must issue credential

Providers must hold credential

AC

Accountability

IS

Information Security

PS

Privacy Compliance

• Where an entity processer mobile credential data for legal purposes …. (out of scope) - or records of access

• Clarity on meaning of consent needed.