DRAFT 2018-03-21 Meeting notes

• Call to order
• Roll call
• Agenda bashing
• Organization updates

• Meeting was called to order and the roll was called
• Please ensure that you sign the Group Participation Agreement

• Please review these blogs offline for current status on Kantara and all the DG/WG:

  • Director's Corner
  • Working + Discussion Group Activity

Motion to approve DRAFT 2018-03-21 Meeting notes

Moved by:

Seconded:

Result:

Motion to approve DRAFT 2018-02-21 Meeting Notes Consent Management Solutions WG

Moved by:

Seconded:

Result:

Motion to approve and adopt the Draft WG Charter (CMS)

Moved by: Julian Ranger

Seconded: Corné van Rooij

Result: Motion carried

Motion to elect Corné van Rooij as WG Chair and Jim Pasquale as WG Vice-Chair

Moved by: Julian Ranger

Seconded: Pushpalanka Jayawardhana

Result: Motion carried

Introductions

Demonstration of iWelcome and digi.me product flows

• Andrew requested to start recording the meeting to capture the demonstrations. No objections raised.
• Jim Pasquale of digi.me presented the digi.me Consent Access flows
  • Jim noted that he is presenting beta software, so please do not capture and share any screen shots of the software
• Corné presented the iWelcome demo
  • Showed the component diagram of the core engine
  • Showed an example customer journey
  • Q: This showed fine-grained consents - other apps show coarse-grained. Which is better? A: The trend is to start at coarse and move to fine as needed.
  • Q: Data minimization pushes towards fine-grained consent approach. A: In GDPR - the requirement is to be unambiguous, etc. which drives towards fine-grained. But it does not restrict how this is achieved. Only coarse-grained is not OK - but progressive granularity is OK.
  • Q: One-layer versus two-layer notice/consents approach (also seen in the ISO work) - needs further discussion
  • Q: Revocation - is there a global revocation feature or a 'suspend processing' feature? A: There is not really a Pause/Suspend - interesting idea... Jim notes that 'pause' and fine-grained consent control is available in digi.me
    • NOTE: Should allow the individual to obtain a copy of the Consent Receipts - to allow cross-domain sharing and parsing of consents and processing instructions/restrictions
  • Q: Is there a Processing Purposes schema? A: Yes - for next call
  • Ken Klingenstein would like to demonstrate their Privacy Manager
    • NOTE: Wants to dig into Purposes more
    • NOTE: Wants to compare Consent APIs too
  • Q: Where are the consent records stored in the infrastructure? A: In the iWelcome infrastructure, not the client's - an API-enabled central store.
    • Ken: in their enterprise version they can force a re-consent action for all users. Corné: can do this for Privacy policy or Terms of service (but this is not the type of consent mentioned in GDPR).
  • Q: How are modifications to consent handled - are records modified or new records created? A: iWelcome writes a new consent record for each consent interaction.

Events that Kantara will have an active role: https://kantarainitiative.org/events/

Next WG meeting Wednesday, April 4, 2018 14:00 UTC / 15:00 BST / 10:00 EDT