DRAFT 2018-03-21 Meeting notes

5 min

• Call to order

• Roll call

• Agenda bashing

• Organization updates

Chair

• Meeting was called to order and the roll was called

• Please ensure that you sign the Group Participation Agreement

• Please review these blogs offline for current status on Kantara and all the DG/WG:

  • Director's Corner

  • Working + Discussion Group Activity

5 min

WG Motions
Quorum required 

Chair

Motion to approve DRAFT 2018-03-21 Meeting notes

Moved by:

Seconded:

Result:

Motion to approve DRAFT 2018-02-21 Meeting Notes Consent Management Solutions WG

Moved by:

Seconded:

Result:

Motion to approve and adopt the Draft WG Charter (CMS)

Moved by: Julian Ranger

Seconded: Corné van Rooij

Result: Motion carried

Motion to elect Corné van Rooij as WG Chair and Jim Pasquale as WG Vice-Chair

Moved by: Julian Ranger

Seconded: Pushpalanka Jayawardhana

Result: Motion carried

5 min

Introductions

All

40 min

Notice and Consent flows - walkthrough

Corné and Jim

Demonstration of iWelcome and digi.me product flows

• Andrew requested to start recording the meeting to capture the demonstrations. No objections raised.

• Jim Pasquale of digi.me presented the digi.me Consent Access flows

  • Jim noted that he is presenting beta software, so please do not capture and share any screen shots of the software

• Corné presented the iWelcome demo

  • Showed the component diagram of the core engine

  • Showed an example customer journey

  • Q: This showed fine-grained consents - other apps show coarse-grained. Which is better? A: The trend is to start at coarse and move to fine as needed.

  • Q: Data minimization pushes towards fine-grained consent approach. A: In GDPR - the requirement is to be unambiguous, etc. which drives towards fine-grained. But it does not restrict how this is achieved. Only coarse-grained is not OK - but progressive granularity is OK.

  • Q: One-layer versus two-layer notice/consents approach (also seen in the ISO work) - needs further discussion

  • Q: Revocation - is there a global revocation feature or a 'suspend processing' feature? A: There is not really a Pause/Suspend - interesting idea... Jim notes that 'pause' and fine-grained consent control is available in digi.me

    • NOTE: Should allow the individual to obtain a copy of the Consent Receipts - to allow cross-domain sharing and parsing of consents and processing instructions/restrictions

  • Q: Is there a Processing Purposes schema? A: Yes - for next call

  • Ken Klingenstein would like to demonstrate their Privacy Manager

    • NOTE: Wants to dig into Purposes more

    • NOTE: Wants to compare Consent APIs too

  • Q: Where are the consent records stored in the infrastructure? A: In the iWelcome infrastructure, not the client's - an API-enabled central store.

    • Ken: in their enterprise version they can force a re-consent action for all users. Corné: can do this for Privacy policy or Terms of service (but this is not the type of consent mentioned in GDPR).

  • Q: How are modifications to consent handled - are records modified or new records created? A: iWelcome writes a new consent record for each consent interaction.

5 min

Upcoming conferences and events

Andrew

Events that Kantara will have an active role: https://kantarainitiative.org/events/

5 min

AOB

Chair

Joss: MyDate conference: interoperability track - last week of August - The WG to submit a proposal by 30 April

Adjourn

Chair

Next WG meeting Wednesday, April 4, 2018 14:00 UTC / 15:00 BST / 10:00 EDT

Look at iWelcome Processing Purposes schema on next call

Andrew

Joss would like to talk about COEL standard and how it relates to Consent Receipts/Management

Joss Langford

Ken would like to present their Privacy Manager

Ken Klingenstein