ANCR: Transparency Performance Report

Editor(s)

Mark Lizar, WG Editor

Contributors

Salvatore D’Agostino, WG Chair

Gigliolla Agassini, WG Secretary

Tim Lloyd

Tim Reiniger

Daniel Schleifer

v. 0.8.9

Abstract 

The capacity to consent is underpinned by the privacy principle of openness, and knowledge of to whom one consents to is critical. Openness is a fundamental democratic requirement, entrenched in legislation in all countries, culture and governing contexts. When any type of identification or recorded surveillance of individuals occurs, identification of who the PII Controller is, that is who is doing the surveillance, must be presented. Trust, in the protection and control of personal information, in both physical and online spaces, requires the presentation and the identification of who is accountable.

For safety, security and privacy in digital identification technologies, transparency is required for inclusive identification, and required prior to collecting and processing personal data. This is a foundational requirement for consent to be legally, technically, or ethically possible. This transparency is the focus and goal of this document.

the

This document specifies four (4) Transparency Performance Indicators (TPIs) that indicate if Consent is valid for any surveillance context. They are used here to create a Transparency Performance Report (TPR) wherein a record of transparency is generated, where the performance is measured to determine if consent is valid, and operable.

The resulting PII Controller identification record is evidential as it is defined here with ISO/IEC 29100:2024 Privacy framework, using the Kantara Consent Receipt v1.1, which has evolved now into the ISO/IEC 27560:2024 Consent record information structure. It is applied here to enable the measure of international (internet) legal adequacy, of transparency for consent. This represents, and is required as, the underlying legal justification for digital identification management technologies.

Without a presentation of Controller identification, there is no legal or technical way for people to be informed about who is in control and accountable for the security, privacy, and sovereignty of surveillance. (in short how trustworthy is “digital trust”). Without this there is no traceability or accountability for misinformation, independent of service providers, much like running a business without auditing or accounting with generally accepted principles. This requirement is not only essential for human security, it is also compulsory for consent, or any type of legitimate processing regardless of justification or Controller.

Transparency modalities take the form of the timing and type of notice required to authorize organizations to collect, process or otherwise surveil an individual, Transparency is required to not only meet legal obligations but also for the capacity to trust and enforce accountability for all security and privacy stakeholders.

The audience for this transparency report are individuals, organizations, developers, and regulators. The objective of this report is to support these stakeholders in observing the active state of transparency and its performance. This is particularly relevant for the governance of surveillance in information and communication technology (ICT) environments. By providing a structured framework for recording and evaluating transparency, the TPR’s objective is to assist stakeholders in navigating complex security and privacy considerations while fostering innovation in digital trust transparency and its legal compliance.

The TPR provides a minimum consent and sovereign security validation tool for digital surveillance, identification and artificial intelligence (AI) technologies. It assesses whether transparency is operational and secure as a necessary prerequisite for consent. It has an extensive scope of application and can be extended into an international and inclusive benchmark. The TPR reports on Controller identification transparency rather than the technical details, or implementation mechanisms of technology. The specifics depend on various contextual factors beyond the scope of this report framework. Instead, the TPR provides a foundational approach to measuring transparency in PII processing, which can be extended in context by regulatory requirements.

IPR Option:

This Anchored Notice and Consent Receipt (ANCR) WG Recommendation is open and can be used royalty-free under the ANCR WG IP license, patent and copyright (see: Reciprocal Royalty Free with Opt-out to Reasonable and Non-discriminatory (RAND) license agreement at the Kantara Initiative for its use and contribution to ISO/IEC SC 27 WG 5).

Any derivative use of this specification must not create any dependency that limits or restricts the open use, transparency, accessibility, or availability of the specification and/or its use to measure the performance of transparency and/or the ability for the PII Principal to receive a notice receipt, or to manage or present a notice receipt as a record of and for the authoritative use of PII Principal consent.

Suggested Citation: (upon WG and Kantara Approval)

Kantara Initiative, 2024: ANCR Transparency Performance Report v 1.0

Conditions for use

License Condition:

This document has been prepared by participants of Kantara Initiative Inc. ANCR-WG. No rights are granted to prepare derivative works of this ANCR Scheme outside of the ANCR WG. Entities seeking permission to reproduce this document, in whole or in part, for other uses must contact the Kantara Initiative to determine whether an appropriate license for such use is available.

Implementation or use of this document may require licenses under third party intellectual property rights, including without limitation, patent rights. The participants and any other contributors to the specification are not and shall not be held responsible in any manner for identifying or failing to identify any or all such third-party intellectual property rights. This Specification is provided "AS IS," and no Participant in Kantara Initiative makes any warranty of any kind, express or implied, including any warranties of merchantability, non-infringement of third-party intellectual property rights, or fitness for a particular purpose. Implementers of this Transparency Performance Indicators specification are advised to review the Kantara Initiative’s website (Kantara Initiative: Trust through ID Assurance )¹ for information concerning any Necessary Claims Disclosure Notices that have been received by the Kantara Initiative Board of Directors.

Dear reader,

Thank you for reviewing this specification in its preparation for publication and contribution. The Kantara Initiative is a global non-profit dedicated to improving secure, private and trustworthy use of digital identifier surveillance through innovation, standardisation, and good practice.

The Kantara Initiative, known internationally for incubating innovative governance technologies, operates Identification Trust Assurance Frameworks to assure digital identification practices are developed with community-led best practices and specifications. Its efforts are acknowledged by OECD ITAC, UNCITRAL, ISO SC27, and other consortia and governments around the world. “Nurture, Develop, Operate” captures the rhythm of Kantara in consolidating an inclusive, equitable digital economy offering value and benefit to all.

Every publication, in every domain, is capable of improvement. Kantara Initiative ANCR WG welcomes and values your contribution through membership, sponsorship and active participation in community driven working groups² that drive all endeavors so that Kantara can reflect its value back to you and your organization.

Copyright: The content of this document is copyright of Kantara Initiative, Inc.
© 2024 Kantara Initiative, Inc.

Scope

This document specifies a methodology for observing, interpreting, and measuring the performance of PII controller identification transparency, providing a standardized structure for reporting and capturing evidence of (digital trust) compliance. It records and indicates how transparent digital identification surveillance is for humans.

The use of this report provides evidence of the validity and legitimacy of consent for PII processing utilizing Transparency Performance Indicators (TPIs). TPI’s capture the PII Controller³ required , security, privacy information focusing on capturing the first notification online independently of the PII controller to generate a controller record, e.g. for example for data processing on a website. Specifically, the four (4) TPIs measure; 1. timing, 2. content, 3. accuracy/ accessibility/usability of content, and 4. sovereignty/contextuality of security. Together, they capture the state of operational capacity for transparency with respect to conformance and compliance.

Legal transparency can be measured against international Convention 108+ Privacy Treaty, utilizing the ISO/IEC JTC 1 WG 5 29100:2024 (Information technology — Security techniques — Privacy framework) and associated standard to record the transparency modality by creating a PII controller record. A record which can measure the performance of legislated law and or practice against the international Treaty. Also referred to as the global privacy policy framework, Convention 108+. The controller record, along with ISO/IEC 29100:2024, is also interoperable with ISO/IEC 27001:2022 standard and framework. (Information security, cybersecurity and privacy protection — Information security management systems — Requirements),

The PII Controller identification and access record generated with this methodology has many applications, and can be used for both security and privacy benchmarking, and for evidence, conformance, auditing compliance and transparency signalling.

.

Normative References

Convention 108+ International Treaty

1. Council of Europe, Convention 108+, an international treaty expected to be fully ratified in 2025, provides a formal global security and privacy framework.

2. It provides the standard instructions and requirements for the signatory countries to implement interoperable privacy law, and/or privacy law that is deemed adequate.

3. The treaty, in particular transparency of processing, and notification requirements, guides and provides the logic of the performance report and its measures as referenced in the appendix

4. It provides and international measure of common legal best practice.

ISO/IEC 29100:2024 Security and privacy techniques, along with source bibliography

This standard is open and free to access “relates to PII in all ICT environments, specifying a common privacy terminology; defining the actors and their roles in processing PII; describing privacy safeguarding requirements; and referencing known privacy principles.”⁴

• Actors and roles;

• Interactions;

• Recognizing PII;

• Privacy safeguarding requirements;

• Privacy policies;

• Privacy Controls.”⁵

Kantara Initiative, Minimum Viable Consent Receipt, & Consent Receipt v1

(published in ISO/IEC 29184:2020 Online privacy notice and consent appendix b) - providing a common transparency schema used to make the report.

Note: Presented in support of Canadian meaningful consent regulation in 2017. Submissions: Kantara CISWG: Consent Receipt Specification - August 2016

Terms & Definitions

Accessibility

Completeness

Choice

First Notice

Identity

Identification

Notice Type

• Identification Notice

• Just in Time Notice,

• Privacy Statement

• Privacy Policy (regulated or unregulated)

Permission

Secure Transparency

Timing: Controller Identification Timing

operational transparency

Transparency Performance

Abbreviated terms

• ANCR WG Anchored Notice and Consent Receipt

• ISO/IEC

• PII personally identifiable information

Methodology

The transparency modality is captured, recorded and measured using the PII Controller identification record (Appendix A). This records transparency performance, to assess if transparency is valid, operable, and secure, i.e., sufficient, for consent, using the l TPIs, or justified, in the case of non-consent based surveillance.

Transparency Performance Indicators(TPIs)

These four (4) Transparency Performance Indicators, are very specifically articulated to measure a transparency modality for valid consent, how meaningful it is, and operationally capable, to assess conformance with international (Internet suitable) Convention 108+, standard global privacy framework.

Consent is Valid if PII Controller identification is provided before data collection, partially valid if before processing with for example low risk pseudonymous identifiers, and not valid if identification is provided after processing. Consent is measured as capable of being Meaningful, if access to security and privacy is proportionate to data collection, sovereign and access capable.

Transparency Performance Indicators are;

Timing of PII Controller identification:

Captures the timing of controller identification presentation. It assesses if identification was provided prior to collection, before, or after processing PII.

Presence of compulsory identification:

Records the extent to which the compulsory Controller identification attributes are provided (Present/Not Present)

Security and Privacy Rights Access:

Measures how accessible the above compulsory controller identification information is in the service session context. In addition it measures how accessible is the Controller security and privacy access point, and assesses how accurate, complete and operational (i.e., usable) this information is in practice.

Security and Sovereignty:

This indicator records the digital certificate(s), keys and other tokens that may be employed to secure the technical interaction and or encrypt a session. It examines Identification, Location, Jurisdiction, and governance sovereignty (source of authority) information from the first 3 TPIs compared with the technical security information recorded in this 4th TPI (the associated certificates, object identifiers, policy and associated endpoint if accessible), for a measure of sovereign security integrity. While this is further facilitated by network connectivity it is possible to provide some or all this information in the form of an offline document.

Considerations

Only identification and access is measured, as these indicators assess the conformance and compliance that is globally required for surveillance, authentic (i.e., from a legitimate authority) security, and privacy. This does not assess services specific information, for example; purpose, legitimacy of processing, authority to process PII (i.e. the grant of permission for processing), or a more granular scope of processing, beyond what is sovereign, It provides often missing requirements for digital identification, referred to here and also known as surveillance trust requirements.

In physical spaces, Controller identification, security and rights access should, and in many cases, MUST be attached to surveillance signs, posted at the entry to physically, whether by a person or through the use of digital technologies, surveilled and secured spaces. In the case of online services, or on a device, all screens and user interfaces can be considered a notice, wherein Controller identification is required to be and can be presented.

Note: this v1 is simplified from previous versions in a number of ways providing room for iteration. Measurement, and analysis, here has been reduced to the most basic elements to measure transparency performance. This v1 is intentionally has reduced measurement to a 3 point metric, but the original design is to include, dynamic or contextually operational in context, and analogue for functional, as there currently is no measure for active state or how operational personal data is in data silo’s, even though operational personal data is a legal requirement for security services in article 72 0f the EEMA version of the GDPR and the cyber resilience act.

After some testing and implementation feedback, the metrics are expected to evolve in this direction for performance measurement.

Note: beyond comments, we invite additional analysis. and reporting questions, which can be provided with the data collected and evidenced in a PII Controller Identification Record. Including extra data collection from external sources.

Transparency Performance Indicator Metrics, Analysis, and References

The primary authoritative reference is the Convention 108+, as this treaty specifies the requirements for adequacy which countries implement as legislation that can be enforced to ratify the Convention. The convention itself is based on principles widely implemented even in non-commonwealth countries. As a result, Convention 108+ is the authoritative privacy policy for adequacy with regards to global Internet and digital privacy. It is used here to extend the use of ISO/IEC 29100, which is used to specify and record the Controller information.

While the TPI’s can be used to quickly self-assess transparency, its performance, capacity and security, the methodology requires that the technical environment should be captured for evidential quality. In addition to TPI’s, the notice type, device type, operating system, discovery software (e.g. a web browser and version), and any search tool. See Appendix A, Supplementary capture record.

TPI 1 - Measuring the time of Controller Identification:

This TPI captures the point in time the notice was presented versus when PII is collected, and when PII is processed.

Analysis;

Note: The measurement scale, 0 (low risk consent/consensu) is for low risk partial compliance and conforms to a decision by the European Data Protection Board (EPDB) on the 16th of January 2025. Pseudonymous data is a type of personal data according to the EDPB, “if the additional information needed to attribute it to an individual is held by someone else.” As a result, pseudonymised identifiers, or credentials, don't automatically become anonymous in the hands of a third party who does not have access to the additional information.

For valid, and meaningful consent, the individual must be informed of what pseudonymous information was collected, before it is processed. Similar to showing live Video Surveillance on a screen at the point of surveillance.

Legal or Standard Reference for timing of controller identification

TPI 2 - Controller Identification RecordElements

This TPI captures the ‘compulsory controlled identification and access attributes into a PII Controller identification record (Appendix A)

Compliance Analysis of compulsory identification attributes

These PII Controller identification elements MUST be provided by the PII Controller and are compulsory, although advanced and dynamic access, using existing records or receipts that might also meet the requirements of functional compliance,

Legal & Standard references for compulsory identification elements

PII Controller Record Conformance

PII Controller ‘identity’ requirements captured in Controller Identification presentation, in an explicit security presentation, or a privacy notice statement can use the ISO/IEC 29184:2020, or 27560:2024 or the Kantara Consent Receipt v1.1 for Controller identity and consent record and format.

Note: Record, attributes and format has been widely implemented in industry, to include

Legal Entity (or natural person) Name and/or trading name.

1. Legal Entity Address

2. Legal jurisdiction(s)Controller Privacy Access point and Contact when applicable

3. The means for accessing privacy and transparency

4. Privacy policy or access point

TPI 3 - Security and Privacy Access

This TPI measures the accessibility of the Controller identification presentation and means for accessing rights.

Analysis of Access

This indicator also takes into account the additional Controller information and

data collected for the TPI and includes, device and user-interaction, accessibility, language of presentation, the number of “screens” that must be traversed to access and use privacy information to exercise the PII Principals rights.

Legal References for Accessibility of security and privacy rights access

TPI 4: A measure of security information integrity

This TPI captures the relevant digital certificate(s), (e.g. x.509), or security token(s), e.g., (Javascript Object Signing and Encryption (JOSE) or Concise Binary Objection Representation (CBOR), and/or verifiable credential or mobile driver license documents (i.e., Decentralized Identifiers (DIDs) v1.0 or mDOC) nd keys to compare the public security meta-data, and policy objects against the required information in TPI 2. It checks for consistency and continuity in the security provided and is adequate.

Analysis

Legal Reference

Reporting Summary

This ANCR WG Recommendation provides a method to assess the governance of digital identification systems, for valid consent in 4 ways, with key metric indicators to signify compliance. It introduces a Transparency Performance Indicators (TPI’s) methodology to generate a report on the state of transparency. It can be further used, independently, to control identification data with the application of privacy rights. The report that is generated, can be reused by the PII Principal, as a PII Controller transparency record, and sent back to the Controller, to establish a common state of understanding of data governance, and access to digital identity privacy rights. . The objective of the recommendation is to establish with this report, in particular the use of TPI’s to provide a standard method of recording digital transparency, which is critical to governance and its enforcement.

This version 1.0 report is the first step; we look forward to its continuing evolution.

ISO/IEC 29100 Terminology Bibliography

[1] ISO Guide 733, Risk management — Vocabulary

[2] ISO 31000, Risk management — Guidelines

[3] SC 27 committee document 502 — Privacy References List, available at: https://committee.iso .org/home/jtc1sc27

[4] ISO/IEC 27000:2018, Information technology — Security techniques — Information security

management systems — Overview and vocabulary

[5] ISO/IEC 27001, Information security, cybersecurity and privacy protection — Information security management systems — Requirements

[6] ISO/IEC 27002, Information security, cybersecurity and privacy protection — Information security controls

[7] ISO/IEC 27003, Information technology — Security techniques — Information security management systems — Guidance

[8] ISO/IEC 27004, Information technology — Security techniques — Information security management — Monitoring, measurement, analysis and evaluation

[9] ISO/IEC 27005, Information security, cybersecurity and privacy protection — Guidance on managing information security risks

[10] ISO/IEC 27006, Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems

[11] ISO/IEC 27007, Information security, cybersecurity and privacy protection — Guidelines for information

security management systems auditing

[12] ISO/IEC TS 27008, Information technology — Security techniques — Guidelines for the assessment of information security controls

[13] ISO/IEC 270094), Information technology — Security techniques — Sector-specific application of

ISO/IEC 27001 — Requirements

[14] ISO/IEC 27010, Information technology — Security techniques — Information security management for inter-sector and inter-organizational communications

[15] ISO/IEC 27011, Information technology — Security techniques — Code of practice for information security controls based on ISO/IEC 27002 for telecommunications organizations

[16] ISO/IEC 27013, Information security, cybersecurity and privacy protection — Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1

[17] ISO/IEC 27014, Information security, cybersecurity and privacy protection — Governance of information security

[18] ISO/IEC TR 27016, Information technology — Security techniques — Information security management — Organizational economics

[19] ISO/IEC 27017, Information technology — Security techniques

[20] ISO/IEC 29100:2024 Information technology – Security techniques - Privacy Framework

Appendix A: PII Controller identification record

Supplementary Dependent on Transparency Modality.

Appendix B Role Mapping Across Privacy and Security Instruments

ISO/IEC 29100 security and privacy framework standard maps terms in the standard itself, for example PII Principal is mapped to the Data Subject.

The ANCR Record Framework is used to specify Transparency Performance Indicators (TPIs)

Table 1. Role Mapping

Quebec, Bill 64 - [1] An Act to modernize legislative provisions as regards the protection of personal information, SQ 2021, c 25,

(compliance roles, mapped to be interoperable within data privacy framework)

Roles in this document refer to a record of relationship between the Individual and any digital service, as documented by the Controller identity schema for TPI assessment.

¹ (Kantara Initiative: Trust through ID Assurance

² Kantara Initiative hosts a number of work groups which work at the apex of digital identification and trust, and assurance.

⁴ ISO/IEC 29100:2024, “1 Scope: This document provides a privacy framework which:” pg 1.

⁵ ISO/IEC 29100:2024, “ 5.1 Overview of the privacy framework The following components relate to privacy and the processing of PII in ICT systems and make up the privacy framework described in this document: pg.4

³ The term controller is used with multiple adjectives in this document. One source of this is different terminology for a category of actor (see Appendix A. Table 1). Further it is possible for the person to be subject, controller, and object granted. Another is the specific type of controller action taken. In the case of the PII Controller, here, the action measured is notice and so with it the specific role of the PII Controller as Notice Controller.