ANCR Digital Transparency Performance Scheme: Parts 1 and 2

Conformity & Compliance Assessment v0.9.9

ANCR refers to an Anchored Notice & Consent Receipt, it is a record that is generated using the Transparency Performance Indicator assessment, which provides a standard measure of operational performance of the present PII Controller’s security and privacy session information.

Editor(s):

Mark Lizar, WG Co-Chair, WG Editor

Contributors

• Sal D’Agostino, WG Co-Chair

•  

•  

•  

Reviewers:

• Sharon Polsky (tbd)

• Paul Knowles (tbd)

•  

IPR Option:

This ANCR Record Specification is required to be open, as specified under a Patent & Copyright: Reciprocal Royalty Free with Opt-out to Reasonable and Non-discriminatory (RAND) license agreement at the Kantara Initiative for submission to ISO/IEC SC 27 WG 5.

Any derivative use of this specification must not create any dependency that limits or restricts the use, accessibility, and availability of the scheme for its used to evaluate the performance of transparency or the ability for the PII Principal to provide and manage consent records.

Suggested Citation: (upon WG approval)

ANCR Digital Transparency Performance Scheme, Part 1 & 2 v1.0

NOTICE

This specification relies on (open access to) ISO/IEC 29100 Security and privacy techniques, to provide framework and ISO/IEC 29184 Online Privacy Notice information structure, Consent Notice Receipt in the Appendix B, further specified by ANCR Mirrored Record Information Structure,³ Consent Notice Receipt Format as specified in the Kantara Initiative ANCR WG Mirrored Record information structure, extending the CISWG MVCR and Consent Receipt v1.1.⁴

Conditions for use

License Condition:

This document has been prepared by participants of Kantara Initiative Inc. ANCR-WG. Permission is hereby granted to use the document solely for the purpose of implementing the Specification for public benefit. No rights are granted to prepare derivative works of this Scheme outside of the ANCR WG. Entities seeking permission to reproduce this document, in whole or in part, for other uses must contact the Kantara Initiative to determine whether an appropriate license for such use is available.

Implementation or use of this document may require licenses under third party intellectual property rights, including without limitation, patent rights. The Participants and any other contributors to the Specification are not and shall not be held responsible in any manner for identifying or failing to identify any or all such third-party intellectual property rights. This Specification is provided "AS IS," and no Participant in Kantara Initiative makes any warranty of any kind, expressed or implied, including any implied warranties of merchantability, non-infringement of third-party intellectual property rights, or fitness for a particular purpose. Implementers of this Specification are advised to review the Kantara Initiative’s website (Kantara Initiative: Trust through ID Assurance ) for information concerning any Necessary Claims Disclosure Notices that have been received by the Kantara Initiative Board of Directors.

Dear reader,

Thank you for downloading this publication prepared by the international community of experts that comprise the Kantara Initiative. Kantara is a global non-profit ‘commons dedicated to improving trustworthy use of digital identity and personal data through innovation, standardization, and good practice.

Kantara is known around the world for incubating innovative concepts, operating Trust Frameworks to assure digital identity and privacy service providers and developing community-led best practices and specifications. Its efforts are acknowledged by OECD ITAC, UNCITRAL, ISO SC27, other consortia and governments around the world. “Nurture, Develop, Operate” captures the rhythm of Kantara in consolidating an inclusive, equitable digital economy offering value and benefit to all.

Every publication, in every domain, is capable of improvement. Kantara welcomes and values your contribution through membership, sponsorship and active participation in the working group that produced this and participation in all our endeavors so that Kantara can reflect its value back to you and your organization.

Copyright: The content of this document is copyright of Kantara Initiative, Inc.
© 2024 Kantara Initiative, Inc.

Abstract 

In context of processing personally identifiable information a PII Principal is not able to see who is processing their data, nor are they notified when their data is disclosed or scraped off the internet. As a result the ability for all stakeholders, in particular the PII Principal, or Individual, is limited in their capacity to trust the use of digital identifying and tracking technologies.

The TPS addresses this issue by providing a standard digital trust conformance and compliance record harness for assessing the performance of transparency and accountability when PII Controllers process personal data.

<snip>

The ANCR mirrored record information structure defines 3 types of digital trust, and provides transparency assessment scheme for primary digital trust, (also referred to as a human centric) data control and accountable transparency.

1. Primary Digital Trust –

   1. when the PII Principle Controls their own PII, enabling transparency over processing, like on a local device

2. Secondary Digital Trust

   1. When the PII is held by a PII Controller

3. Exterritorialy  

   1. When PII is disclosed and controlled by a 3^rd party (not a PII Processor)

      1. Emergency services

      2. Security Services

  

If the PII Principal is not able to understand and “see” how PII (Personally Identifiable Information) is shared, disclosed, or managed it is not possible to trust the service processing PII with any additional assurancs.

1. All data processing must have a record of notified processing activity. In order toThis is a requirement to be digitally transparent. The exception is when it is , unless required not to bethere is a by legal derogation, which is required notification, often as risk that is provided prior to consent based processing of PII.  Even  Iin such an instance, the processing must be transparent to the appropriate regulatory authority, according to the context of processing.  

2. This assessment scheme in this way, can be applieds to all any services context and every stakeholder; , PII Controller, PII Processor, PII Principal’s, the PII Co-Regulating Authority and delegates.  

3. All processing with consent already requires a record of the privacy notice and privacy policy link, which in this assessment scheme, the record that is generated for assessment  in this document is referred to asis called a Notice Receipt, also known a in the s the ANCR mirrored record of consentinformation structure. , and referred to as a consent record in ISO/IEC 27560 Consent record information structure.  

4. In GDPR and Records and receipts provided in this scheme as are specified in Convention 108+, Art 31 these records are called a Record of Processing Activity (RoPA), used in this framework as proof of transparency/knowledge.  . The consent receipt is effectively a digital twin, of this RoPA, which is a mirrored – linked notice and consent micro-data record, which is also held by the individual. This Record can then effectively become the authoritative consent record.  

  

A Notice Receipt can be created by anyis created to assess in this framework stakeholder to identify a PII Controller. 

An Anchored Notice and Consent Receipt can be used as a record of consent to access data subjects' rights, for example, and/or to test and assess the operational performance of PII Controllers’ digital privacy performance in digital contexts.  

Part 1 of the scheme introduces 4 Transparency Performance Indicators; these are used to measure and rate the conformance of transparency.  In Part 2 of the scheme (in the Appendix A) a transparency information request is sent to the controller to; a) test the controller information and, b) measure how compliant the performance of digital transparency is, to both legal expectations, and the personal privacy expectations of the PII Principal.   

, n

Terms & Definitions

Normative to Council of Europe, Convention 108+,

The normative language for the TPI Scheme is defined by Convention 108+, the commonwealth privacy convention the GDPR (General Data Protection Regulation) 108+ was created to establish a set of principles and rules to effectively safeguard personal data and facilitate cross-border data flows

Normative terms for roles defined in national law are mapped to the roles which are defined according to an international adequacy baseline.

ISO/IEC 29100 is also normative, this security and privacy framework standard maps terms in the standard itself, for example PII Principal is mapped to the Data Subject.

The ANCR Record Framework is used to specify Transparency Performance Indicators (TPIs) and is based on the consent receipt work where roles are mapped to standards and laws.

(compliance roles, mapped to be interoperable within any data privacy framework)

Roles in this document refer to a record of relationship between the Individual and any digital service, as documented by identifiers. Primary digital trust is technically identified

Introduction

Transparency Performance Indicator’s (TPI’s) are introduced here as an object of conformity used to capture the presentation of PII Controller (Credential) information, to measure this information to determine its completeness,, accessibility and security. Its operational data governance capacity per context can then be assessed against international adequacy baseline for compliance.

In this way TPI’s can quickly be used to determine the validity, quality, and governance of data process for digital and physical assessment contexts.

The TPI’s are employed to assess digital privawcy transparency for human context.

About the Scheme

The TPI Scheme presented here is scoped to international/internet scale digital commonwealth transparency adequacy baseline for trans-border digital consent capable records of transparency. The TPS includes:

A conformity and compliance assessment scheme, implemented in 2 parts to generate a full operational transparency report.

• TPI Scheme 1 Part 1 - Conformance

  • Initial test to diagnose the operational capacity of privacy services in any specific context.

• TPI Scheme 1 Part 2 – Compliance (found in Appendix A)

  • Specifies an example operational transparency compliance performance test, in which the transparency is tested by generating a privacy rights-based request, to access privacy services.

Part 1 refers to conformance with digital identifier elements of the PII Controller required to be presented to initiate a session and is the body of this document.

Part 2 is Appendix A and uses the ANCR record to audit the Adequacy of the captured controller elements as specified in the Council of Europe, Conv. 108+. Article 14, Transparency Modalities.

How Does the scheme Operate?

an ANCR (Anchored Notice and Consent Receipt) Notice Receipt Record, which is assessed as a ‘proof of notice’ (or knowledge record ) claim, conformant as a Consent Notice Receipt as a record format to perform an ISO/IEC conformant digital privacy transparency compliance assessment, against international technical and legal baselines.

The Scheme employs TPI’s to measure the operational performance of transparency and accountability This is used to determine the capacity for dynamic control of personal data, in an online service context. .

The ANCR record is produced from a TPI Assessment which captures the identity of the controller and accountable person, contact and physical address. In this way the presented digital governance and surveillance context can be assessed for compliance for transborder flows of data,

What Do TPI’s Measure

There are 4 Indicators specified in this scheme used to measure the existence and performance of the publicly required digital service information. The TPIs check digital components, and identify the governance model, authority, and security framework to assure the validity of the privacy state in an online service context. This provides privacy risk assurance for people.

Indicators are captured at the point of notice presentation to capture the required PII Controller privacy rights access point(s), and the governance framework personal data processing is being governed.

How Does the Scheme Work

The TPI’s for conformance in the capture of privacy information or services are mapped to analogue legal requirements which measure response times in days, out of technical context.  TPIs all measure how dynamic privacy service information is in context, and provide a rating, from -3 to +1, in which +1 is for a Dynamic, in context transparency performance indicator. This introduces the concept of a shared active privacy state transparency, comprised of the signal that indicates if the privacy as expected in context.

Background

At the time of writing this Scheme, transparency, and consent is governed predominately by commercial governance frameworks that utilize digital identity management technologies to identify people. At the same time the associated services do not identify themselves in a standard way online, which is neither compliant nor conformant, introducing critical cybersecurity risks.

Individuals are forced to give up digital privacy to access analog privacy rights and services online. All the records of digital relationships (like cookies) are managed by services. Without personal records of digital relationships Individuals are not able to access the information independent of a relying party, which is necessary to measure privacy and security transparency performance of a notice its basis for processing, including and importantly the validity of digital consent.

These risks and harms are exacerbated when PII Principals use privacy services online. PII identifiers, by default, is micro-data that is captured and collected at an attribute level (then aggregated into meta-data).

The end result, individuals must provide raw data attributes, create a profile to access services online. These “security” technologies themselves are used to scrape, profile and track data subjects presenting a systemic challenges to digital privacy for the PII Principal.

The second systemic obstacle to second party management of first party data, is that individuals do not have a copy of their own records of digital identity relationships. The lack of record standards have prevented people from being able to exercise rights outside of a service context.

A standard notice receipt and consent record address this systemic challenge, producing a proof of notice and evidence of consent, for consent tokenization (consent receipt v2).

This Transparency Performance Scheme is extensible, Part 1, is the data commons level first step to generating the digital evidence for authentic consent in online services using terms and conditions based privacy poicy frameworks..

TPIs assess when the notice is presented, if the notice information provided is contextually relevant, if the contact information is fake or not, is it usable reciprocally, and proportionally, and if a digital service can represent policy and security required for digital privacy. The information and understanding gained from applying these indicators are a necessary precondition for processing of personal data as well as meaningful consent.

Digital transparency requires a record to provide a standardized purpose specification so as to include who the beneficiary of data is, how they benefit, and where the benefit and value originates. This information once collected in a standard credential, record, and receipt format can be assessed in the Scheme.

The security and privacy risks can then be assessed relevant to the data processing context to provide for an informed choice about whether to provide additional permissions, withdraw consent, or even pause consent to a service, and stop tracking for a particular digital context.

4 TPI’s

The 4 Transparency Performance Indicators capture transparency and data capture practices in context and are used to test the self-asserted information for its operational usability.

These 4 TPIs Part 1, and the associated receipt and record Part 2 can be used together with the other Appendices for public interest application, such as a listing of the Controller credential encompassing the TPIs and associated assessment. The scheme is directed at providing a basis for required public security and privacy transparency assurance.

TPIs specified focus is on the initial point of contact. This includes the publicly required information that MUST be provided and refers to the PII Controller Identity and Contact information, which is required in all legal privacy instruments. Transparency, in this regard, is a universal requirement, and required for the free, prior, and informed consent necessary to scale digital privacy online and as a means of governing and providing trust in authority.

The TPIs here are used to assess session-based data capture and self-asserted information by organizations to specify a public level of trust assurance that is provided in an online context.⁵

TPI 1 - Measuring the Timing of PII Controller Identity Notification:

This TPI captures when the Controller's legal entity and accountable Privacy Officer (digital identifiers) provide notice of their identity. This is measured to see if the notice is delivered

1. Before,

2. At the time of,

3. During, or

4. After

Personally identifiable information is captured.3

By assessing dynamic and operational transparency, as opposed to static, infrequent information, it provides a way for an individual to assess if they can trust a service or not. This is also assessing compliance with Article 14.1, and specifically defined in Article, 15 1, a) and b)

Information to be provided where personal data are collected from the data subject

1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

(a)  the identity and the contact details of the controller;

(b)  the contact details of the data protection officer;

TPI 2 - Measures Required Data Elements

This TPI captures whether the required security and privacy attributes are provided,⁶ These are required to provide the PII Controller information for all accountable parties. Namely who and what information about them is legally required. In “all” cases, there is a requirement for a Notice of who is processing your data, who is accountable, and the privacy contact information for access to personal information and rights and as required. [Art 14.1]

A first-time notice must exhibit two (2) factors (2FN), 1) is the notice adequate as notice of risk, and 2) are the practices relating to permissions permitted by the purpose, accepted, which can then be used as proof of notice by the data subject.

The required Digital Privacy Transparency (notice) elements are:

1. Legal Entity Identity Name,

2. Address, Contact information

3. Name or role of Data Privacy Officer (or the authoritative owner and Accountable Person (AP) in charge of that legal entity.

4. Privacy services access and contact point information.

5. Privacy or other policy governing the processing of personal information.

6. Transparency information before use

   1. Digital governance framework

   2. Legal Basis for Purpose of initial Processing of PII

   3. Recipients or categories of recipients if any

   4. Transfer of data on networks out of Country, to a 3^rd Country,

   5. The existence of adequacy,

   6. Existence of safeguards, where to get a copy of them, or where they have been made available.⁷

TPI 3 - Measure of Transparency Accessibility

This TPI measures the performance of transparency in terms of accessibility to the information in TPI 2. For example, is the information readily available, ideally prior to the digital session and capture of PII. For example, is TPI-2 information presented in a pop-up notice at the initiation of a digital service session, or is it required to click a link, e.g., to a privacy policy, and then access additional link. , Is the operational transparency information on the first screen, or is it at the bottom reached only after scrolling multi-pages, with links not highlighted, and not accessible to children or parents.

In this way TPI 3 measures Informational accessibility. This is a key transparency metric that indicates if the context of digital privacy is capable of being inclusive and accessible and trustworthy. This measure is extended to include the exercise of rights on the part of the PII Principal to determine how adequately Controllers respond.

TPI 4: A Measures security information integrity

This TPI captures the relevant digital certificates, (e.g. x.509), or security token (e.g. JOSE) and keys to compare the security meta-data, and policy objects against the required information in TPI 2. It checks for consistency and continuity in the security provided and is it adequate for the task. E.g., does an SSL certificate Organization Unit and Jurisdiction fields match the captured legal entity information? How do the policy and jurisdiction there relate to other beneficial entities? Importantly does this align with the policy expectations of the person?

TPI Metrics

Transparency Performance Rating

The TPI Rating system is designed to measure dynamically the operational transparency and performance of the required security and privacy information and its usability. The scale applied penalizes bad behavior more than it rewards conformance and compliance from +1 “good” to -3 “bad”. These are presented one by one and then in a table for comparison followed by an example in the next section.

For TPI 1:

• +1 refers to the existence of a technical framework and PII Controller transparency prior to the initiation of a session. This provides security-based trust assurances for the data subject.

• 0 refers providing dynamic transparency in context at the start (which is at the time of collection), including purpose and other required disclosures,

• -1 refers to where the legally required information is presented at some point in the session.

• -2 refers to the provision of low quality legally required information.

• -3 refers to the provision of non-operable, non-compliant, unusable transparency and digital privacy related information.

For TPI 2

• +1 is given for each of the Controller information of the elements

• -3 if the information is missing.

For TPI 3

• +1 for meeting legal requirements for responsiveness for each of the required PII Controller information categories.

• -2 for response but not within legal requirements

• -3 if information unavailable

For TPI 4

• +1 There exists a security notice before processing with the contextual integrity of each the security features.

• 0 There exits contextual integrity of each the security features

• -1 if security information matches controller but policy not contextual (specific to the use case and purpose)

• -2 if security key information does not match controller information, e.g. in the Organizational Unit (OU) and Common Name (CN) in the session certificate.

• -3 for each integrity mismatch

Table 1: Transparency Performance Indicator Record Ratings

The following shows how TPIs work together as timing is relevant to all the TPIs.

Table 2: Transparency Performance Indicator Record Rating Example

Summary

In summary, Transparency Performance Scheme and Indicatorsare specified here for people to use in context in combination with out of session elements, independently of service providers to gain an understanding of digital identifier relationships. TPIs are digital transparency tools used to self-determine how much a service in context can be trusted.

These TPIs are designed to work with open standards, and licenses, e.g. ANCR WG royalty free license, and open-source software to provide adequate, and scalable Transparency conformance. Transparency tools are required to be open in multiple ways so that people can use and create records they can own and keep across and independently of service providers. It is a cornerstone of agency that the scheme puts in place.

TPI 1 is a measure of trust, so that when asked, “Do you trust (accept) a service”, you necessarily know who is processing your data before, during or after.” Overwhelmingly people indicate trust would be higher. if notified prior to data capture, which only makes sense.

TPI 2 is the legally required attributes, present and available. Are they machine readable

TPI 3 is an indicator of how accessible, and inclusive, digital transparency is. Are the transparency attributes machine readable.

TPI 4 validates for the individual if security “matching the controller jurisdiction” to addresses a critical cross-border security challenge widely overlooked today.

This is a 1.0 document; we look forward to its evolution.

TPI Compliance Assessment Scheme Part 2

Operational Transparency Assessment

The following describes an assessment using the TPIs to measure Operational Transparency and assurance.

Most often for the PII Principal there are missing identifying attributes, controlled, and held by PII Controllers with commercial interests., that are required for operational digital governance, This scheme looks to systemically capture and maintain these attributes as digital commons assets turned into public infrastructure to support Operational Transparency.

1. Transparency is required to be available in context, i.e., during the time when PII is obtained (found in Transparency Statement or Privacy Policy).⁸

   1. Time period data stored.

   2. Existence of rights/controls to access and rectify.

   3. Existence of right to manage consent.

   4. Existence of right to lodge a complaint with a Data Protection Authority (DPA).

   5. Whether processing is based under a statutory, or contractual context, or whether necessary for entering a contract, if the PII is obliged, and the consequences of failure to provide this data.⁹

   6. Existence of

      1. AI, or any automated decision-making technology

      2. Digital identity management surveillance technologies

      3. Any profiles, or graphs generated

      4. Meaningful information about the logic involved

         1. Significance in overall policy or processing and decision making

         2. Expected consequences for and to PII Principal - Data Subject

TPI Assessment Guidance

The TPI Rating system is designed to measure the operational performance of the information, for example if only a mailing address is provided for a privacy contact on a website, this is considered non-operable according to the context. This means that privacy access and specific information is not retrievable in the context of data collection. The TPIs measure adequacy and demonstrate non-performance by PII Controllers as a form of data co-governance.

The associated Conformity Assessment: uses the open ISO/IEC 29100 security framework for generating interoperable records and receipts of data processing activity, according to transparency in context.

TPIs are captured in sequence

a. TPI 1 measuring the point when the individual is notified versus when personal information/digital identifiers are collected and processed. The scheme starts by capturing the timing of notice presentation in relation to first data capture, and first contact.¹⁰

b. TPI 2 measuring the contents of the notification for required PII Controller digital attributes that correspond to the physical brick and mortar attributes specified in privacy, security, safety, and surveillance legislation. This is the PII Controller identity and entity information and access point.

c. TPI 3 measures how usable are the contents (information record) of the PII Controller entity, and its identity information and access point.

d. TPI 4 validates the coherence of cybersecurity information versus the digital transparency information capturing and comparing the SSL certificate and/or tokens/keys and associated meta-data (e.g. object identifiers, and certificate policies).

Combined, these TPIs provide an overall Indication of the operational state of digital privacy.

TPI – Scheme 1, Part 1(S1-P1) metric logic

1.2.    Table 2: ANCR Mirrored Record Schema Example

This appendix is an example of a notice record and the schema and can be used as a template for the information record, rating, and analysis.

Digital Transparency Code of Conduct

These digital transparency code of conduct rules coincide with the TPIs presented and reference the international adequacy requirements for transparency required for digital identifier management. In Report on the Adequacy of Digital Identity Governance for cross border transparency and consent:

PII Controller must:

1. Provide their PII Controller Notice Credentials, before or at the time of processing personal information (TPI 1), Article 14.1

2. PII Controller credential information must be accessible

3. PII Controller credential information must be operationally capable for access to rights with evidence of notice & consent

4. The security context must match the controller’s jurisdiction where it is assumed PII is processed

Appendix D. References

Council of Europe 108+

¹

²

³ Mirrored Record Information Structure, 2024, ANCR WG Kantara Initiative { https://kantara.atlassian.net/wiki/spaces/WA/pages/304480257/ANCR+Mirrored+Record+Information+Structure+v0.7}

⁴ Consent receipt v1, CISWG Kantara Initiative https://kantarainitiative.org/download/7902/

⁵Note to reader: The ANCR Record Framework presents 4 levels of transparency assurance for PII Controller (Notice) Credentials, which can be use in 3 vectors of digital governance; 1. Personal data control 2. Data Protection 3. Co-regulation, i as assessed in this document at assurance level 0.

⁶ This is the most common legislated privacy element in the world, required and mappable to all privacy legislation and instruments. (ISTPA 2007)p.64

⁷ An international repository would be an ideal for framework when accessing thes first-time sign or notice.

⁸ A second factor notice must be linked to the first notice receipt/record to provide proof of notice and state.

⁹ This is missing from CoE 108+ - but required element to include in the Code of Conduct.

¹⁰ Flows for return visits can make use of receipts that capture the state of the relationship on first contact, and record and maintain any change of state thereafter for any use by any controller, including joint controllers, sub-controllers, processors, and sub-processors.

^I