By: Mark Lizar

1. The PII Controller Notice Identification Record is a common public format containing legally required controller attributes, so the information is operationally usable.

2. This information is required to be provided consistently such that it is Provided, Open, Accessible, Verifiable, and proportionate and fit for purpose.

3. This is public transparency infrastructure. It is the bedrock upon which information can be trust-capable.

   • Reference: ISTPA (p.64) operational privacy principles.

Through deep research conducted through the development of the Minimum Viable Notice Consent Receipt for digital-id technologies, we discovered that notice is technically the governance vehicle for digital consent.

All jurisdictions and laws require notice. In fair systems, notice must come before an individual is required to make a decision. This is because transparency requires both notice and awareness.

The research behind this is extensive. Add an appendix or a link to Global Privacy Rights Controls.

This PII Controller identification record is the security part of the minimum viable consent receipt, which is the original work. It is now 4th generation record. It is in the appendix of 29184. It was the basis for the Kantara Consent receipt v1.1, and then ISO/IEC 27560 Consent record information structure.

It was first published as 0PN Schema, in semantics workshop, and is the record that is used to capture PII Controller identification information in the ANCR WG Transparency Performance Report. The fields are referenced to an internationally interoperable legal and technical standard.

This specification provides mapping of the controller credential role in multiple jurisdictions, and guidance on extending the record to generate a notice and consent receipt.

• MVCR Consent Receipt

This ANCR WG Recommendation is open and can be used royalty-free under the ANCR WG IP license, patent and copyright (see: Reciprocal Royalty Free with Opt-out to Reasonable and Non-discriminatory (RAND) license agreement at the Kantara Initiative for its use and contribution to ISO/IEC SC 27 WG 5).

Any derivative use of this specification must not create any dependency that limits or restricts the use, accessibility, and availability of the specification and/or its use to measure the performance of transparency and/or the ability for the PII Principal to receive a notice receipt, or to manage or present a notice receipt as a record of and for the authoritative use of PII Principal consent.

Suggested Citation (upon WG approval):

• Kantara Initiative, 2025: ANCR Transparency Performance Report v 1.0

License Condition:

This document has been prepared by participants of Kantara Initiative Inc. ANCR-WG. No rights are granted to prepare derivative works of this ANCR Scheme outside of the ANCR WG. Entities seeking permission to reproduce this document, in whole or in part, for other uses must contact the Kantara Initiative to determine whether an appropriate license for such use is available.

Implementation or use of this document may require licenses under third party intellectual property rights, including without limitation, patent rights. The participants and any other contributors to the specification are not and shall not be held responsible in any manner for identifying or failing to identify any or all such third-party intellectual property rights. This Specification is provided "AS IS," and no Participant in Kantara Initiative makes any warranty of any kind, express or implied, including any warranties of merchantability, non-infringement of third-party intellectual property rights, or fitness for a particular purpose. Implementers of this Transparency Performance Indicators specification are advised to review the Kantara Initiative’s website (Kantara Initiative: Trust through ID Assurance) for information concerning any Necessary Claims Disclosure Notices that have been received by the Kantara Initiative Board of Directors.

Dear reader,

Thank you for reviewing this specification in its preparation for publication and contribution. The Kantara Initiative is a global non-profit dedicated to improving secure, private and trustworthy use of digital identifier surveillance through innovation, standardisation, and good practice.

The Kantara Initiative, known internationally for incubating innovative governance technologies, operates Identification Trust Assurance Frameworks to assure digital identification practices are developed with community-led best practices and specifications. Its efforts are acknowledged by OECD ITAC, UNCITRAL, ISO SC27, and other consortia and governments around the world. “Nurture, Develop, Operate” captures the rhythm of Kantara in consolidating an inclusive, equitable digital economy offering value and benefit to all.

Every publication, in every domain, is capable of improvement. Kantara Initiative ANCR WG welcomes and values your contribution through membership, sponsorship and active participation in community driven working groups that drive all endeavors so that Kantara can reflect its value back to you and your organization.

Copyright: The content of this document is copyright of Kantara Initiative, Inc. © 2025 Kantara Initiative, Inc.

The PII Controller Identification record is specified here as its own specification, along with how it can be used to generate a notice record and consent record and receipt, in line with (proposed changes to 27560) for consent-capable notice and consent records and receipt.

This specification recommends the use of this core identification record as the preferred stand format for this scheme, so as to interoperate with the ANCR Transparency Performance Reporting PII Controller identification record, which also requires a publically required and open identifier.

In this specification we provide security and privacy considerations for a data governance role specific to blinding the identification of the PII Controller, linked PII Principal identification information, using the international transparency (aka notice and consent record and receipt policy and technology framework as specified with the consent receipt v1.1 work).

In the appendix there are the ISO/IEC Standards and standard bibliography that this Controller identification is interoperable with by default.

The key words MUST, SHOULD, and MAY in this document are to be interpreted as described in RFC 2119.

• MUST: required for conformance.

• SHOULD: recommended for conformance unless superseded by a documented and justified derogation.

• MAY: optional.

An Access Gateway is the safety, security, surveillance, privacy, and consent notice access point location and use information.

This table consists of the compulsory attributes.

• PII Controller refers to the interacting party.

• Data Controller refers to the controller accountable for protecting personal data, which is commonly the same or equivalent to the Data Controller.