OASIS PMRM TC Informal Meeting: 29 Sept 2010 - in conjunction with the OASIS Identity Management Conference in DC

["Michael Willett" <mwillett@nc.rr.com>]

The following PMRM TC members were available to meet for a half-day in DC:

Michael Willett: ISTPA

John Sabo: CA Technologies

Bob Sunday: Govt of Canada

Gershon Janssen: (individual) Consultant

Bill Tabor: WidePoint

Abbie Barbir: Bank of America

Peter Alterman: NIH

John and Michael ran through the PMRM tutorial that is

available (voice animated) on the OASIS webinar web site, sparking much discussion.

It was suggested that relevant additional docs be uploaded to the PMRM web site:

   - voice-animated tutorial webinar: Making Privacy Operational at

            http://www.oasis-open.org/events/webinars/

   - PMRM V2.0:

             http://www.oasis-open.org/apps/org/workgroup/pmrm/download.php/39397/ISTPAPrivacyManagementReferenceModelV2%200.pdf

A number of issues were identified and discussed informally:

1.  Terminology – consistency needed – perhaps submit to ITU-T
2. PI definition: If PI is defined too broadly, then potential for null set – can stymie operation -
3. >>> See ISO/IEC -29100
4. Note:  in ISO, “Frameworks” may be available without cost, as opposed to ISO standards
5. Are Assurance Levels for Privacy needed?
6. Need to mature the PMRM document and establish as a draft
7. Solicit editors for new PMRM, Use Cases, and Liaisons
8. Process for Use Case acceptance
9. Select Use Case methodology (how to express a Use Case): Ideas? Informal expression to start
10. Peter Alterman will provide a Use Case for utilizing the normative aspects of the PMRM for evaluating comparability of federated privacy policies and practices;

plus, a template for compliance, based on the “normative” subset of the PMRM

John Sabo and Michael Willett will develop and distribute an agenda for our next formal meeting on 14 Oct.