OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

coel message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: [coel] COEL-54 Consent


BEGIN:VCALENDAR
X-LOTUS-CHARSET:UTF-8
VERSION:2.0
PRODID:-//Lotus Development Corporation//NONSGML Notes 9.0.1//EN_C
METHOD:REQUEST
BEGIN:VTIMEZONE
TZID:GMT Standard Time
BEGIN:STANDARD
DTSTART:19501029T020000
TZOFFSETFROM:+0100
TZOFFSETTO:+0000
RRULE:FREQ=YEARLY;BYMINUTE=0;BYHOUR=2;BYDAY=-1SU;BYMONTH=10
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:19500326T020000
TZOFFSETFROM:+0000
TZOFFSETTO:+0100
RRULE:FREQ=YEARLY;BYMINUTE=0;BYHOUR=2;BYDAY=-1SU;BYMONTH=3
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
DTSTART;TZID="GMT Standard Time":20160209T090000
DTEND;TZID="GMT Standard Time":20160209T110000
TRANSP:OPAQUE
DTSTAMP:20160208T074350Z
SEQUENCE:0
ATTENDEE;ROLE=CHAIR;PARTSTAT=ACCEPTED;CN="Paul Bruton/Tessella"
 ;RSVP=FALSE:mailto:Paul.Bruton@tessella.com
ATTENDEE;ROLE=REQ-PARTICIPANT;PARTSTAT=NEEDS-ACTION;RSVP=TRUE
 :mailto:coel@lists.oasis-open.org
CLASS:PUBLIC
DESCRIPTION;ALTREP="CID:<FFFF__=0FBBF5C0DFB9EC148f9e8a93df938690918c0FB@>":_
 _________________\n\n\n\nWorking with potential customers for the COEL
  standard\, I have noticed that main concern for the larger customers 
 in this space is currently managing consent – proving to themselves 
 that they have the consent for any action\, acting on the consent wish
 es of their customers and the ability to demonstrate this to the regul
 ator.\n\n \n\nThe atom structure has the potential for us to record t
 he consent associated with any piece of data within the data. In addit
 ion\, we can use an atom to record consent activities (providing\, cha
 nging\, revoking\, agreeing to data sharing\, etc.). A proposed soluti
 on for issue COEL-54 is to add an optional field to the BAP for consen
 t recording and raise an issue to include consent actions into the COE
 L model.\n\n \n\nThere is an existing stream of work in this area cal
 led the Minimum Viable Consent Receipt (MVCR) which has many of the at
 tributes that we would need:\n\nhttps
 ://kantarainitiative.org/groups/ciswg/\n\nhttps
 ://github.com/KantaraInitiative/CISWG/blob/master/MVCR-Spec/mvcr-v.08/
 MVCR%20v0.7.1.md\n\nhttp
 ://mvcr.herokuapp.com/\n\nI have spoken with one of the chairs\, Mark 
 Lizar\, and he is keen to explore how we might work together. This ope
 n standard work is based in JSON on very similar IPR terms to ours.\n\
 n \n\nThe MVCR programme has a wider scope that we initially need but
  provides the basic information needed to record consent (which I have
  summarised below). The programme extends to a registry of privacy pol
 icies and a consent receipt management system. I believe we could choo
 se at which level we wanted to integrate – the BAP and COEL model ad
 ditions would be a simple and productive first step. \n\n \n\nConsent
  fields
 :\n\n \n\nJurisdiction                        
                                  New B
 AP field (country look-up)\n\nTimestamp                
                                    
       New BAP field (date when consent was given)\n\nMethod of co
 llection                               
        New BAP field (look-up)\n\nConsent provider       
                                    
    Possible new BAP field (this provides the link to the consent rec
 ord management)\n\nUnique ID                     
                                    
     Possible new BAP field (unique ID for consent record management
 )\n\nPII principle                          
                               Not needed (
 ConsumerID)\n\nData controller                    
                               Not needed (
 ServiceProviderID)\n\nPrivacy Policy URL               
                              New BAP field
  (could be IDA\, or other\, inc policy notice)\n\nPurposes      
                                    
                     New BAP field (look-up http
 ://tinyurl.com/zchqhut)\n\nSensitive Personal Information       
            Not needed (all COEL might be sensitive)\n\n3rd P
 arty Sharing of Personal Info            Possible New BAP f
 ield (might help with data sharing between Service Providers)\n\nLink 
 to short privacy notice                        
   Not sure we need this (see above)\n\nOauth Scope          
                                    
          Not sure we need this\n\n(Retention period)     
                                    
   New BAP field (this is not in the MVCR spec but I think it is usefu
 l)\n\n                \n\nBest regards\n\nJoss\n\n \n\
 n \n\nJoss Langford\n\nTechnical Director\n\nActivinsights Ltd \n\n 
 \n\nTel
 : 01480 862080\n\nMBL 07712 886208\n\nwww.geneactiv.co.uk \n\n \n\nIm
 portant Information
 :  The contents of this email are intended for the named addresses on
 ly and contain information which is confidential and which may also be
  privileged.  Unless you are the named addressee (or authorised to re
 ceive for the addressee) you may not copy\,  use it\, or disclose it 
 to anyone else.  If you received it in error\, please notify us immed
 iately at enquiries@activinsights.co.uk and then destroy it.  Further
 \, whilst we make efforts to keep our network free from computer virus
 es\, etc.\, you do need to check this email and any attachments to it 
 for viruses as we can take no responsibility for any viruses which mig
 ht be transferred by way of this email. \n\n \n\nActivinsights Limite
 d\, Unit 11\, Harvard Industrial Estate\, Kimbolton\, Cambs\, PE28 0NJ
 .  A company registered in England & Wales. Registered number
 : 06576069\n\n 
SUMMARY:[coel] COEL-54 Consent
ORGANIZER;CN="Paul Bruton/Tessella":mailto:Paul.Bruton@tessella.com
UID:BA75FF2DC277D9E880257F53002A6A84-Lotus_Notes_Generated
X-LOTUS-BROADCAST:FALSE
X-LOTUS-UPDATE-SEQ:1
X-LOTUS-UPDATE-WISL:$S:1;$L:1;$B:1;$R:1;$E:1;$M:1;$W:1;$O:1;RequiredAttendees:1;INetRequiredNames:1;AltRequiredNames:1;StorageRequiredNames:1;OptionalAttendees:1;INetOptionalNames:1;AltOptionalNames:1;StorageOptionalNames:1;ApptUNIDURL:1;STUnyteConferenceURL:1;STUnyteConferenceID:1;SametimeType:1;WhiteBoardContent:1
X-LOTUS-NOTESVERSION:2
X-LOTUS-NOTICETYPE:I
X-LOTUS-APPTTYPE:3
X-LOTUS-CHILD-UID:BA75FF2DC277D9E880257F53002A6A84
END:VEVENT
END:VCALENDAR

GIF image

GIF image



__________________



Working with potential customers for the COEL standard, I have noticed that main concern for the larger customers in this space is currently managing consent – proving to themselves that they have the consent for any action, acting on the consent wishes of their customers and the ability to demonstrate this to the regulator.

 

The atom structure has the potential for us to record the consent associated with any piece of data within the data. In addition, we can use an atom to record consent activities (providing, changing, revoking, agreeing to data sharing, etc.). A proposed solution for issue COEL-54 is to add an optional field to the BAP for consent recording and raise an issue to include consent actions into the COEL model.

 

There is an existing stream of work in this area called the Minimum Viable Consent Receipt (MVCR) which has many of the attributes that we would need:

https://kantarainitiative.org/groups/ciswg/

https://github.com/KantaraInitiative/CISWG/blob/master/MVCR-Spec/mvcr-v.08/MVCR%20v0.7.1.md

http://mvcr.herokuapp.com/

I have spoken with one of the chairs, Mark Lizar, and he is keen to explore how we might work together. This open standard work is based in JSON on very similar IPR terms to ours.

 

The MVCR programme has a wider scope that we initially need but provides the basic information needed to record consent (which I have summarised below). The programme extends to a registry of privacy policies and a consent receipt management system. I believe we could choose at which level we wanted to integrate – the BAP and COEL model additions would be a simple and productive first step.

 

Consent fields:

 

Jurisdiction                                                         New BAP field (country look-up)

Timestamp                                                         New BAP field (date when consent was given)

Method of collection                                      New BAP field (look-up)

Consent provider                                             Possible new BAP field (this provides the link to the consent record management)

Unique ID                                                            Possible new BAP field (unique ID for consent record management)

PII principle                                                        Not needed (ConsumerID)

Data controller                                                  Not needed (ServiceProviderID)

Privacy Policy URL                                            New BAP field (could be IDA, or other, inc policy notice)

Purposes                                                             New BAP field (look-up http://tinyurl.com/zchqhut)

Sensitive Personal Information                  Not needed (all COEL might be sensitive)

3rd Party Sharing of Personal Info            Possible New BAP field (might help with data sharing between Service Providers)

Link to short privacy notice                          Not sure we need this (see above)

Oauth Scope                                                      Not sure we need this

(Retention period)                                          New BAP field (this is not in the MVCR spec but I think it is useful)

               

Best regards

Joss

 

 

Joss Langford

Technical Director

Activinsights Ltd

 

Tel: 01480 862080

MBL 07712 886208

www.geneactiv.co.uk

 

Important Information:  The contents of this email are intended for the named addresses only and contain information which is confidential and which may also be privileged.  Unless you are the named addressee (or authorised to receive for the addressee) you may not copy,  use it, or disclose it to anyone else.  If you received it in error, please notify us immediately at enquiries@activinsights.co.uk and then destroy it.  Further, whilst we make efforts to keep our network free from computer viruses, etc., you do need to check this email and any attachments to it for viruses as we can take no responsibility for any viruses which might be transferred by way of this email.

 

Activinsights Limited, Unit 11, Harvard Industrial Estate, Kimbolton, Cambs, PE28 0NJ.  A company registered in England & Wales. Registered number: 06576069

 

Attachment: c074350.ics
Description: Binary data



[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]