Discussion topics on consent and notification
- Ken Klingenstein (Unlicensed)
Consent and Notice Topics
A set of issues we’ve encountered in trying to deploy practical and effective consent/notification/compliance infrastructure at scale.
Note Bene:
In the real world, apps and SP’s do subsequent and out of band ways to gather personal data from users.
Our model is transactionally oriented but includes a “while I’m away” capability that applies to batch feeds, unattended apps, etc.
Cognitive load is a real concern
Purpose of use:
Is it specified on a per attribute basis, or just for the overall bundle of attributes requested?
Required versus optional attributes
How to characterize the distinction between the two – what functionalities and attributes in an app are considered optional
How does this relate to data minimization principles
Obfuscation?
What’s adequate for law (and where is that specified) and what’s functional for the user to handle?
Selective release of values from a multivalued attribute (common example – our schema includes the multivalued attribute group memberships for users and
Are there SP to IdP signaling mechanisms to indicate what types of values are needed by the SP?
Community-oriented schema
To facilitate citizen-gov interactions