...

Introduction

In privacy regulations and for decentralized identity, transparency is a key requirement. As identifiers are personal, used to track, surveil and profile its not only important to know who controls  personal information, but it's required for consent, a critical component of security and a pre-requisite for digital privacy.  Most notices, notifications, T&C's don't use standards to provide the transparency over who control's personal information.  

...

• 0PN  Transparency WG: Decentralized Data Governance
  • eNotice and eConsent identity & data governance information structure  
• ISO/IEC 29100
  • ISO/IEC 29100:2011 provides a privacy framework which. specifies a common privacy terminology; defines the actors and their roles in processing personally identifiable information (PII); describes privacy safeguarding considerations; and. provides references to known privacy principles for information technology.
  • ISO/IEC 29184 Online Privacy Notice & Consent 
  • ISO/IEC 27560 WD 5 Consent record information structure 
• ISO 27002 Series : WG 5 SC27
  • ISO 27001 sets forth the compliance requirements needed to become certified. In contrast, ISO 27002 is a set of guidelines that are designed to help you introduce and implement ISMS best practices.
• CoE 108+
  • International GDPR - 
    • data governance framework which provides the international enforcement policy baseline suitable for internet scale data control, identity transparency governance and consent
• W3C Data Privacy Vocabulary 
  • V.5
• Kantara
  
  • ANCR Notice Record

Specification Overview 

This specification builds upon the Kantara ANCR Record specification (and Consent Reciept)(ref) to build a notice controller credential for specifying all of the PII Controller's information in a eNotice record. 

...

ISO/IEC 29184 - Online Privacy Notice and Consent Controls  - 

Fields Added to ANCR Record to Create Verifiable Credential

ANCR Record spec - is here (enter link)

...

1. Controller Type[Ctype]:  
   1. Notice Controller,  
   2. PII notice controller,  
   3. PII controller,    
   4. PII surveillance controller , (info not provided by PII Principle) 
   5. [Ctype] controller operator, 
2. Accountable Person Type

Assessment

ANCR Record provides a PII Controller Digital privacy transparency KPI, be assessing a notice for digital and physical controller identification and privacy access information, as required for the operational use and management of digital identifiers. 

The Controller Credential assessment tests this credential for its transparency performance. 

Security Considerations

The use of blinding identity taxonomy for personal identifiers includes the Accountable person identifiers, which are required to be published and available in accordance to local legislation. 

The identifiers used in the controller credential are specified according to regulation and implemented with standards in order to be subject to regulation and regulatory considerations, 

Mitigation Risk

Using standard framework for transparency of control with data control defaults 

 Examples

1. Security, 

Controller Credential 

Micro-Credential 

defined as a credential specified to a specific purpose. 

Glossary

Privacy Stakeholders - ISO 29100

Annex: Privacy Stakeholder Mapping to Functional ToiP Roles

Continuing of the ANCR Record Assessment to identify the controller credential,

...

References for Controller Credential, Infrastructure and Legal Framework

Reference: OPN: Open Notice  (+ Consent) Receipt Schema: Starters Guide to Unified Data Control Schema

Lizar, M. & Pandit, H.J., OPN: Open Notice Receipt Schema, 14th International Conference on Semantic Systems (SEMANTiCS 2019), Karlsruhe, Germany, 2019 [Published http://www.tara.tcd.ie/handle/2262/91576 [accessed July 1, 2020]

...