DRAFT 2018-05-02 Meeting notes

• Call to order
• Roll call
• Agenda bashing
• Organization updates

• Meeting was called to order and the roll was called
• Please ensure that you sign the Group Participation Agreement

• Please review these blogs offline for current status on Kantara and all the DG/WG:

  • 2018: March
  • Working + Discussion Group Activity

Meeting was not quorate at the time of motion-making - deferred

Motion to approve DRAFT 2018-04-04 Meeting notes

Moved by:

Seconded:

Result:

Introductions

Mircea Patachi - UNLOQ - working on consent / data privacy platform

Ken Klingenstein - Internet2 - open source consent management platform - developers from Duke University

• Marlena Erdos - Lead Architect

Chris Olsen - Walt Disney - IAM Pro

Presentation/Demo - UNLOQ

Clym - product

• building a fit-for-purpose cookie consent tool
• Target market - SME - a quick way to become minimally compliant for cookie management/consent
  • Feature: Consent transferability between partners
  • NOTE: this might be a good candidate to add to the myData interop demo

• Consent as a Service
• Wants group to discuss 'special categories of data' - how to deal with this - e.g. obfuscation on UI
• "Manage the cognitive load" - lots of UI research on this to make this manageable
  • Use of colors, language, etc
• Demo uses the Duke IdP
• Q: Is there a way to discover the "purpose for processing" on the policy management screen? A: working on adding Purposes now. IDP will need to record the basis for release, but not necessary to present to user all the time. A: The user does see a description - it's not named 'purpose'.
• Trustmarks will be added into the UI - there are operational trustmarks now
• Q: Does CAR adjust the attributes in the SAML assertion on the fly? A: yes - "Information Items" (scopes and claims) are adjusted (based on IDP and RP requirements) and shown to the user as appropriate
• Note: much of this can be shown as Notification instead of Consent if consent is not the justification
• Q: How are the API offerings? A: APIs are open for the Policy aspects - rich set available.
• Q: Have you seen data retention and consent policies yet? A: Not yet - would be good to see new use cases.

Events that Kantara will have an active role: https://kantarainitiative.org/events/

• myData conference Helsinki - the proposal to the Interoperability track has been accepted - contact Jim at digi.me to get in on the demo

Next WG meeting Wednesday, May 16, 2018 10:00 Eastern Daylight Time / 15:00 BST