...
Digital trustworthiness - is about providing people with control of identity relationship records. This specification proposes the use of standardized notice and data control semantics so that people can trust and "see" who (if not oneself), is in control and accountable for personal information. This specification extends the Kantara ANCR Record to product a Notice of Controller Receipt for automating the administration of Online Rights for digital identity systems.
- using privacy rights independent process of service
- people provide consent to a purpose -
- additional notices are not required for consent
- permissions -
- Notes - how to add DPV - as a predefined language ?
Process in progress:
| StatusACTIVE | |
Notice & Consent for people relies on clear communication.Decentralized identity relies on contextual legal semantics and notices by implementors in order to be compliant with sovereign data rights. These semantics need to be standardized to be used by decentralized identifier based technologies for human interoperable data governance. The more unified across ecosystems the notice and risk semantics, the more human centric the service becomes as it lowers the burden on humans and increases the understanding of risks, benefits and (human) consent. | Specification proposal: to extend Decentralized Semantic Governance for a dynamic data control ( DDC) architecture for active control transparency that people can use.
|
Privacy Controller Credential For Data
...
Governance Accountability
This specification is used to standardized the controller record that is used to verify, validate and notarize rights claims for online environments/services. Utilizing semantically standardized notice records and consent receipts, (also known as a Consent Notice Receipt)(ref ISO 29184), in addition to, Data Privacy Vocabulary specified for generating notice and notifications that are both human and machine readable.
This This credential is comprised of the legal entity name and the accountable person as defined by their role in the data organization and documented in the ISO 27560 standard. This record is further specified here for 3 levels of Privacy Assurances for transparency and control of personal data when processing in an ecosystem or supply chain,
...
- The accountable person may or may not be an employee of the organization.
- Different jurisdictions name/define and reference this role differently
- Some jurisdictions, like the UK have a data controller registry (DCR), where this binding is public and legally required (benefit in this case, challenge where absent)and the name of the accountable person is publicly available in ICO DCR. (using blinding identity taxonomy)
- Some jurisdictions, like the EU require an accountable data controller representative in the jurisdiction where a service is operating, in order to address legal data privacy and security issues that may arise.
- 2 or more Controllers might be accountable for processing of personal data.
- Identify in context of service for any user the controller and accountable person.
- The privacy law in some jurisdictions, can itself break privacy law in other jurisdictions by requiring the accountable person information to be published publicly,
- Specifies how to by a VC (in this case the Privacy Controller Credential) for trust assurance for privacy assurance
- International Notice & Control protocol for Unified Data Control & Portable semantics for governance interoperability between domain and jurisdictions.
...