How does this project fit with the strategy?

Information Sharing Interoperability Charter

Project time frame to Completion:

July 2020

Deliverables:

Reports:

Specs: Framework for Extensible Receipts

Recommendation / Practices: Implementation guidance

Why are we doing this?

Objectives

The Consent Receipt v1.1 from Kantara was frozen in 2017 and has seen enormous success as seen, e.g., in adoption across organizations, as it brings efficiency, compliance and user control. The original receipt was primarily aimed at personal information and, to a large extent, driven by upcoming regulations (at the time) such as EU's GDPR. Adaptations to different contexts such as Healthcare or Financial are now common but, as expected, the current specification is often limiting and requires modifications to specific use-cases.

The aim of this project is to create a framework specification that describes the requirements for Data Use Receipts. The framework specification will include mandatory and optional requirements. Communities of interest will create specialized profiles of the framework specification that are customized for their use cases and scenarios.

The framework specification will allow implementers from any community to be assured that their profiled specifications contain the essential element of Data Use Receipts. Different profiles are not expected to be automatically semantically interoperable or technically intereoperable between domains.

How do we judge success?

A published framework specification that describes the requirement for Data Use Receipts and guidelines for creation of profile specifications.

It should be compatible with the current specfication (v1.1).

What are the possible solutions?

What do we already know?

The Kantara Initiative Consent Receipt Specification v1.1 was published by Kantara Initiative in 2017 and several communities and companies have implemented compatible consent receipt definitions.

Inputs:

•  ISO 29184 sister (notice) spec to Kantara Consent Receipt, v1.1 
•  W3C Data Privacy Control Vocabulary
•  OpenConsent: Notice Receipt  &  Poster
•  W3C Data Privacy Vocabulary Controls CG
•  CR v1.1
•  Blinding Identity Taxonomy 

What do we need to answer?

What are we doing?

Why will a customer want this?

Personal record keeping for important events is a well-founded concept. The Personal Data Use Receipt framework specification will allow implementers to offer a standardized person record that corresponds to the data controller's records. Having an independent personal record is a powerful person-enabling capability that companies can use to increase value deliver to people.

Visualize the solution

Scale and scope