2021-04-27 Security, Privacy, and Data Protection Drafting Group Meeting Notes

Attendees

• Abdul Sattar
• Bejoy A K
• Chuck Curran
• Daryl Thomas
• Drummond Reed
• Elli Papgeorgiou
• Harm Jan Arendshorst
• Jan Lindquist
• Jim St.Clair
• Kaliya Young, WG Co-chair
• Ken Adler, Co-chair
• Peter Davis
• Scott Perry
• Trev Harmon, PM

Agenda Items

Recording - Link

Notes

• IP and antitrust announcement.
• Thank you to everyone who has worked hard to get our initial draft in place.
• Ken introduced himself.
• Elli introduced herself.
• Ken presented a diagram on the 5 areas that CISOs look at (CSF diagram): Identity, Protect, Detect, Respond, Recover.
• Chuck asked that we look at a gap analysis of what is missing between that diagram and what we have drafted.
• Jan brought up the previous discussion regarding a DPIA.
• Reviewed the overall draft document.
• We decided to work on item #10 first. Jan walked through the general approach.
• We had a conversation regarding the MUST, SHOULD, and MAY statements.
• Chuck noted some cases where MUST may not be possible to enforce.
• Had a discussion regarding certification.

Chat Log

00:16:21	Ken Adler | ThoughtWorks | San Francisco | He/Him:	https://docs.google.com/presentation/d/1Cw-zQ_QkNDkjPhtaaQJGIQncWVMDBnxb4NG7GH4AmvI/edit?usp=sharing
00:25:34	Trev Harmon:	https://docs.google.com/document/d/1H6hsVVeTfe9YnhKTnqV6h_Q1-KR0659cVelORuF8E-I/edit#
00:26:44	Drummond Reed:	+1 to putting that deep info in an appendix
00:38:40	Drummond Reed:	+1. The MUST statements are by far the most important from a compliance and trust assurance standpoint.
00:45:09	Drummond Reed:	We can’t impose requirements on a govemment
00:47:50	Drummond Reed:	Just to clarify: neither credentials or passes are issued in Zone 1. That is just for the health event. Issuance is in Zone 2.
00:56:43	Drummond Reed:	+1 that it can help with adoption and recognition

Action Items

1. Everyone to review the draft.
2. Those with assigned sections need to have cleaned up the grammatical, punctuation, and other structural comments, leaving only those that need discussion, before our meeting on Thursday.
3. When their section is cleaned up, they need to announce in our group Slack channel that their section is ready for another round of review.