How does this project fit with the strategy?

Information Sharing Interoperability Charter

Project time frame to Completion:

Deliverables:

Reports:

Specs:

Recommendation / Practices:

Why are we doing this?

Problem statement

In order to move from consent to control, it is the case that there needs to be one or more mechanisms to move beyond defective consent models for individuals and organizations to share information at Internet-scale without ceding control of that information to other entities. We call this privacy-preserving information sharing.

Impact of this problem

Once there is a specification and model for sharing information without giving up control, it will enable the creation of user-centred information sharing ecosystem with individuals in control of their own data and co-creators and managers of shared data.

How do we judge success?

This project will be a success when it has created:

• Inventory Report on Privacy-Preserving Information Sharing (See Information Sharing Report)
• MVP: A prose and technical specification of the minimal necessary elements for a valid information-sharing
• The MVP can be added on to with the following:
  • The addition of endpoint specifications to allow information-sharing
  • Specifications for updating and revoking information-sharing
  • API calls
  • User Interfaces
• Real-world implementations of the specification

What are possible solutions?

What do we already know?

There is much work being done in this space, converging on similar issues

• Kantara
  • UMA: https://kantara.atlassian.net/wiki/display/LC/User+Managed+Access
  • Consent Receipt Specification: https://kantarainitiative.org/download/7902/
  • The Information Sharing Report: https://kantarainitiative.org/download/6112/
• Other
  • CommonAccord Data Sharing Object: http://www.commonaccord.org/index.php?action=list&file=S/Index/DataSharing/
  • Me2B: https://www.me2balliance.org/
  • JLINC Protocol: https://protocol.jlinc.org/

What do we need to answer?

What are we doing?

Creating a framework for automating information-sharing agreements to move from consent-based models to permission and contract based models of information sharing.

Why will a customer want this?

End users will want this because instead of ceding control through dark patterns of faux notice and consent, information-sharing agreements can empower the individual.

Organizations will want this because they can address 'data-rot' because customers will be able to signal or communicate their preferences. This de-risks customer data from a privacy perspective and reduces data maintence costs.

Visualize the solution

Scale and scope