Note: the ANCR Notice Receipt Specification is currently in drafting with the to present in September 2024.
This specification defines a PII Controller Identity Record schema that is extensible and used for TPI measurement in this specification.

Editor(s):

Mark Lizar, WG Co-Chair, WG Editor

Contributor(s):

• Sal D’Agostino, WG Co-Chair

• Gigi Agassini, WG Secretary

IPR Option:

This ANCR TPA Scheme is a specification that is required to be open, as specified under the ANCR WG IP License, Patent & Copyright: Reciprocal Royalty Free with Opt-out to Reasonable and Non-discriminatory (RAND) license agreement at the Kantara Initiative for contribution to ISO/IEC SC 27 WG 5.

Any derivative use of this specification must not create any dependency that limits or restricts the use, accessibility, and availability of the scheme and/or its use to evaluate the performance of transparency and/or the ability for the PII Principal to provide and manage consent records.

Suggested Citation: (upon WG approval)

ANCR Digital Identity Trust: Transparency Performance Assessment Scheme, Part 1 & 2 v1.0

NOTICE

This specification relies on (open access to) ISO/IEC 29100 Security techniques, Privacy framework and ISO/IEC 29184 online privacy notices and consent, and ISO/IEC 27560 the Consent Record Information Structure and a Consent Notice Receipt, which is a digitally twinned record information structure based on the Consent Receipt v1.1.⁴

Conditions for use

License Condition:

This document has been prepared by participants of Kantara Initiative Inc. ANCR-WG. No rights are granted to prepare derivative works of this ANCR Scheme outside of the ANCR WG. Entities seeking permission to reproduce this document, in whole or in part, for other uses must contact the Kantara Initiative to determine whether an appropriate license for such use is available.

Implementation or use of this document may require licenses under third party intellectual property rights, including without limitation, patent rights. The participants and any other contributors to the specification are not and shall not be held responsible in any manner for identifying or failing to identify any or all such third-party intellectual property rights. This Specification is provided "AS IS," and no Participant in Kantara Initiative makes any warranty of any kind, expressed or implied, including any implied warranties of merchantability, non-infringement of third-party intellectual property rights, or fitness for a particular purpose. Implementers of this Digital Trust Transparency Scheme specification are advised to review the Kantara Initiative’s website (Kantara Initiative: Trust through ID Assurance ) for information concerning any Necessary Claims Disclosure Notices that have been received by the Kantara Initiative Board of Directors.

Dear reader,

Thank you for reviewing this specification in its preparation for publication and contribution. The Kantara Initiative is a global non-profit dedicated to improving secure, private and trustworthy use of digital identifier surveillance through innovation, standardisation, and good practice.

The Kantara Initiative, known internationally for incubating innovative concepts, operating an Identity Trust Assurance Framework to assure digital identity and privacy service providers and developing community-led best practices and specifications. Its efforts are acknowledged by OECD ITAC, UNCITRAL, ISO SC27, other consortia and governments around the world. “Nurture, Develop, Operate” captures the rhythm of Kantara in consolidating an inclusive, equitable digital economy offering value and benefit to all.

Every publication, in every domain, is capable of improvement. Kantara welcomes and values your contribution through membership, sponsorship and active participation in the working group that produced this and participation in all our endeavors so that Kantara can reflect its value back to you and your organization.

Copyright: The content of this document is copyright of Kantara Initiative, Inc.
© 2024 Kantara Initiative, Inc.

Abstract 

Since the first signatory in 1980, the international standardisation of security and privacy law has been underway to become formalised into regulation that is now enforceable upon its implemented as legislation in Commonwealth countries, like the EU through the General Data Protection Regulation and Canada through Quebec Law 25. This has paved the way for the ratification of the updated to the 108 Convention from the Council of Europe to Convention 108+. The international commonwealth privacy framework, which is interoperable with the ISO/iEC 29100 security and privacy framework, also widely adopted and open access.

4 Transparency Performance Indicators measure the performance of transparency and is used here to measure transparency performance against regulatory requirements

1. Timing: When PII Controller Identity information is provided in accordance with when data is captured, to assess the security and privacy risk and compliance, to determine the legal validity of consent.

2. Content: If required PII Controller Identity information is provided. to assess operational compliance for any legal justification or authority.

3. Usability: Accessibility & Authenticity: of the PII Controller Identity Information, taking into account device accessibility, the language and number of “screens” to access privacy information, and policy, in order to then assess terms and definitions against the legal (and expected) terms and definitions.

4. Contextual Security Integrity: In particular to the contents and policy of digital certificate and keys and related tokens used. Cryptographic soundness, and policy (and its endpoint) for the purpose, e.g. browsing versus consent to processing PII. Further examples, OU match to the PII Controller, Jurisdiction, and (Common) Name, and as match of policy to notice of risk.

In Part 2, the record is used to send a digital privacy rights request, which is then made to operational performance and integrity of the notice, notification and disclosures.

Terms & Definitions

Normative

CoE Convention 108+

ISO/IEC 29100 security and privacy framework standard maps terms in the standard itself, for example PII Principal is mapped to the Data Subject.

Term Mapping

The ANCR Record Framework is used to specify Transparency Performance Indicators (TPIs)

[1] An Act to modernize legislative provisions as regards the protection of personal information, SQ 2021, c 25,

(compliance roles, mapped to be interoperable within any data privacy framework)

Roles in this document refer to a record of relationship between the Individual and any digital service, as documented by identifiers. Primary digital trust is technically identified

Introduction

Transparency Performance Indicator’s (TPI’s) are introduced here as an object of conformity that captures the presented PII Controller (Credential) information, to measure its timing, content, accessibility and security. The operational data governance context and capacity can then be measured against the existing international adequacy baseline for notice and consent compliance.

About the Scheme

The scheme employs TPI’s to measure the operational performance of transparency and accountability. This is used to determine the capacity for dynamic control of personal data, in an online service context.

The ANCR record is produced from a TPI assessment which captures the identity of the controller and accountable person, contact and physical address. In this way the presented digital governance and surveillance context can be assessed for compliance for (transborder) flows of data.

What Do TPI’s Measure

There are 4 Indicators specified in this scheme used to measure the existence and performance of the publicly required digital service information. The TPIs check digital components, and identify the governance model, authority, and security framework to assure the validity of the privacy state in an online service context. This provides privacy risk assurance for people.

Indicators are captured at the point of notice presentation of the required PII Controller privacy rights information access point(s), and the governance framework under which personal data processing is being governed.

How to employ a TPI

TPIs measure how dynamic security and privacy are in a digital or physical surveillance context rating, from -3 to +1, in which +1 is dynamic data in context in context. This introduces the concept of a shared active privacy transparency state. This dial tone/signal indicates if privacy is as expected in context.

TPIs assess when the notice is presented, if the notice information provided is contextually relevant, if the contact information is fake or not, is it usable reciprocally, and proportionally, and if a digital service can represent policy and security required for digital privacy. The information and understanding gained from applying these indicators are a necessary precondition for processing of personal data as well as meaningful consent.

Digital transparency requires a record to provide a standardised purpose specification so as to include who the beneficiary of data is, how they benefit, and where the benefit and value originates. This information once collected in a standard credential, record, and receipt format can be assessed in the Scheme.

The security and privacy risks can then be assessed relevant to the data processing context to provide for an informed choice about whether to provide additional permissions, withdraw consent, or even pause consent to a service, and stop tracking for a particular digital context.

Overview of 4 Transparency Performance Indicators (TPIs)

The 4 Transparency Performance Indicators capture transparency and data capture practices in context and are used to test the self-asserted information for its operational usability.

These 4 TPIs Part 1, and the associated receipt and record Part 2 can be used together with the other Appendices for public interest application, such as a listing of the Controller credential encompassing the TPIs and associated assessment. The scheme is directed at providing a basis for required public security and privacy transparency assurance.

TPIs specified focus is on the initial point of contact. This includes the publicly required information that MUST be provided and refers to the PII Controller Identity and Contact information, which is required in all legal privacy instruments. Transparency, in this regard, is a universal requirement, and required for the free, prior, and informed consent necessary to scale digital privacy online and as a means of governing and providing trust in authority.

The TPIs here are used to assess session-based data capture and self-asserted information by organizations to specify a public level of trust assurance that is provided in an online context.⁵

TPI 1 - Measures the Timing of PII Controller Identity Notification:

This TPI captures when the Controller's legal entity and Accountable Person or Privacy Officer provides their identifiers. This is measured to see if the notice is delivered

1. Before,

2. At the time of,

3. During, or

4. After

Personally identifiable information is captured.

By assessing dynamic and operational transparency, as opposed to static, infrequent information, it provides a way for an individual to assess if they can trust a service or not. This is also assessing compliance with Article 14.1, and specifically defined in Article, 15 1, a) and b).

Information to be provided where personal data are collected from the data subject

1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

TPI 2 - Measures Required Data Elements

This TPI captures whether the required security and privacy attributes are provided,⁶ These are required to provide the PII Controller information for all accountable parties. Namely who and what information about them is legally required. In “all” cases, there is a requirement for a Notice of who is processing your data, who is accountable, and the privacy contact information for access to personal information and rights and as required. [Art 14.1]

A first-time notice must exhibit two (2) factors (2FN), 1) is the notice adequate as notice of risk, and 2) are the practices relating to permissions permitted by the purpose, accepted, which can then be used as proof of notice by the data subject.

The required Digital Privacy Transparency (notice) elements are:

1. Legal Entity Identity Name,

2. Address, Contact information

3. Name or role of Data Privacy Officer (or the authoritative owner and Accountable Person (AP) in charge of that legal entity.

4. Privacy services access and contact point information.

5. Privacy or other policy governing the processing of personal information.

6. Transparency information before use

   1. Digital governance framework

   2. Legal Basis for Purpose of initial Processing of PII

   3. Recipients or categories of recipients if any

   4. Transfer of data on networks out of Country, to a 3^rd Country,

   5. The existence of adequacy,

   6. Existence of safeguards, where to get a copy of them, or where they have been made available.⁷

TPI 3 - Measure of Transparency Accessibility

This TPI measures the performance of transparency in terms of accessibility to the information in TPI 2. For example, is the information readily available, ideally prior to the digital session and capture of PII. For example, is TPI-2 information presented in a pop-up notice at the initiation of a digital service session, or is it required to click a link, e.g., to a privacy policy, and then access additional link. , Is the operational transparency information on the first screen, or is it at the bottom reached only after scrolling multi-pages, with links not highlighted, and not accessible to children or parents.

In this way TPI 3a measures Informational accessibility. This is a key transparency metric that indicates if the context of digital privacy is capable of being inclusive and accessible and trustworthy. This measure is extended to include the exercise of rights on the part of the PII Principal to determine how adequately Controllers respond.

TPI 3b - Measure the semantic accuracy of the terms in the controller notice -

• Cookie = Digital receipt - nmis-information - cause mass damage - liable -

TPI 4: A Measures security information integrity

This TPI captures the relevant digital certificates, (e.g. x.509), or security token (e.g. JOSE) and keys to compare the security meta-data, and policy objects against the required information in TPI 2. It checks for consistency and continuity in the security provided and is it adequate for the task. E.g., does an SSL certificate Organization Unit and Jurisdiction fields match the captured legal entity information? How do the policy and jurisdiction there relate to other beneficial entities? Importantly does this align with the policy expectations of the person?

TPI Metrics

Transparency Performance Rating

The TPI Rating system is designed to measure dynamically the operational transparency and performance of the required security and privacy information and its usability. The scale applied penalise bad behaviour more than it rewards conformance and compliance from +1 “good” to -3 “bad”. These are presented one by one and then in a table for comparison followed by an example in the next section.

For TPI 1:

• +1 refers to the existence of a technical framework and PII Controller transparency prior to the initiation of a session. This provides security-based trust assurances for the data subject.

• 0 refers providing dynamic transparency in context at the start (which is at the time of collection), including purpose and other required disclosures,

• -1 refers to where the legally required information is presented at some point in the session.

• -2 refers to the provision of low quality legally required information.

• -3 refers to the provision of non-operable, non-compliant, unusable transparency and digital privacy related information.

For TPI 2

• +1 is given for each of the Controller information of the elements

• -3 if the information is missing.

For TPI 3

• +1 for meeting legal requirements for responsiveness for each of the required PII Controller information categories.

• -2 for response but not within legal requirements

• -3 if information unavailable

For TPI 4

• +1 There exists a security notice before processing with the contextual integrity of each the security features.

• 0 There exits contextual integrity of each the security features

• -1 if security information matches controller but policy not contextual (specific to the use case and purpose)

• -2 if security key information does not match controller information, e.g. in the Organizational Unit (OU) and Common Name (CN) in the session certificate.

• -3 for each integrity mismatch

Table 1: Transparency Performance Indicator Record Ratings

The following shows how TPIs work together as timing is relevant to all the TPIs.

Table 2: Transparency Performance Indicator Record Rating Example

Summary

In summary, Transparency Performance Scheme and Indicatorsare specified here for people to use in context in combination with out of session elements, independently of service providers to gain an understanding of digital identifier relationships. TPIs are digital transparency tools used to self-determine how much a service in context can be trusted.

These TPIs are designed to work with open standards, and licenses, e.g. ANCR WG royalty free license, and open-source software to provide adequate, and scalable Transparency conformance. Transparency tools are required to be open in multiple ways so that people can use and create records they can own and keep across and independently of service providers. It is a cornerstone of agency that the scheme puts in place.

TPI 1 is a measure of trust, so that when asked, “Do you trust (accept) a service”, you necessarily know who is processing your data before, during or after.” Overwhelmingly people indicate trust would be higher. if notified prior to data capture, which only makes sense.

TPI 2 is the legally required attributes, present and available. Are they machine readable

TPI 3 is an indicator of how accessible, and inclusive, digital transparency is. Are the transparency attributes machine readable.

TPI 4 validates for the individual if security “matching the controller jurisdiction” to addresses a critical cross-border security challenge widely overlooked today.

This is a 1.0 document; we look forward to its evolution.

TPI Compliance Assessment Scheme Part 2

Operational Transparency Assessment

The following describes an assessment using the TPIs to measure Operational Transparency and assurance.

Most often for the PII Principal there are missing identifying attributes, controlled, and held by PII Controllers with commercial interests., that are required for operational digital governance, This scheme looks to systemically capture and maintain these attributes as digital commons assets turned into public infrastructure to support Operational Transparency.

1. Transparency is required to be available in context, i.e., during the time when PII is obtained (found in Transparency Statement or Privacy Policy).⁸

   1. Time period data stored.

   2. Existence of rights/controls to access and rectify.

   3. Existence of right to manage consent.

   4. Existence of right to lodge a complaint with a Data Protection Authority (DPA).

   5. Whether processing is based under a statutory, or contractual context, or whether necessary for entering a contract, if the PII is obliged, and the consequences of failure to provide this data.⁹

   6. Existence of

      1. AI, or any automated decision-making technology

      2. Digital identity management surveillance technologies

      3. Any profiles, or graphs generated

      4. Meaningful information about the logic involved

         1. Significance in overall policy or processing and decision making

         2. Expected consequences for and to PII Principal - Data Subject

TPI Assessment Guidance

The TPI is designed to measure the operational performance of the information, for example if only a mailing address is provided for a privacy contact on a website, this is considered non-operable according to the context. This means that privacy access and specific information is not retrievable in the context of data collection. The TPIs measure adequacy and demonstrate non-performance by PII Controllers as a form of data co-governance.

The associated Conformity Assessment: uses the open ISO/IEC 29100 security framework for generating interoperable records and receipts of data processing activity, according to transparency in context.

TPIs are captured in sequence

a. TPI 1 measuring the point when the individual is notified versus when personal information/digital identifiers are collected and processed. The scheme starts by capturing the timing of notice presentation in relation to first data capture, and first contact.¹⁰

b. TPI 2 measuring the contents of the notification for required PII Controller digital attributes that correspond to the physical brick and mortar attributes specified in privacy, security, safety, and surveillance legislation. This is the PII Controller identity and entity information and access point.

c. TPI 3 measures how usable are the contents (information record) of the PII Controller entity, and its identity information and access point.

d. TPI 4 validates the coherence of cybersecurity information versus the digital transparency information capturing and comparing the SSL certificate and/or tokens/keys and associated meta-data (e.g. object identifiers, and certificate policies).

Combined, these TPIs provide an overall Indication of the operational state of digital privacy.

TPI – Scheme 1, Part 1(S1-P1) metric logic

1.2.    Table 2: ANCR Mirrored Record Schema Example

This appendix is an example of a notice record and the schema and can be used as a template for the information record, rating, and analysis.

Digital Transparency Code of Conduct

These digital transparency code of conduct rules coincide with the TPIs presented and reference the international adequacy requirements for transparency required for digital identifier management. In Report on the Adequacy of Digital Identity Governance for cross border transparency and consent:

PII Controller must:

1. Provide their PII Controller Notice Credentials, before or at the time of processing personal information (TPI 1), Article 14.1

2. PII Controller credential information must be accessible

3. PII Controller credential information must be operationally capable for access to rights with evidence of notice & consent

4. The security context must match the controller’s jurisdiction where it is assumed PII is processed

Appendix D. References

Council of Europe 108+

⁵Note to reader: The ANCR Record Framework presents 4 levels of transparency assurance for PII Controller (Notice) Credentials, which can be use in 3 vectors of digital governance; 1. Personal data control 2. Data Protection 3. Co-regulation, i as assessed in this document at assurance level 0.

⁶ This is the most common legislated privacy element in the world, required and mappable to all privacy legislation and instruments. (ISTPA 2007)p.64

⁷ An international repository would be an ideal for framework when accessing thes first-time sign or notice.

⁸ A second factor notice must be linked to the first notice receipt/record to provide proof of notice and state.

⁹ This is missing from CoE 108+ - but required element to include in the Code of Conduct.

¹⁰ Flows for return visits can make use of receipts that capture the state of the relationship on first contact, and record and maintain any change of state thereafter for any use by any controller, including joint controllers, sub-controllers, processors, and sub-processors.

^I