<div dir="ltr">Thank you for the warm welcome, Gail and Mark. I'd be happy to join an upcoming working group meeting to introduce myself and share a bit more about what we're working on with the Data Rights Protocol. Would it be possible to join the October 20th working group session? <div><br></div><div>I'm also open to having a brief 'side huddle' this week to make sure we make the most effective use of the WG's time by agreeing on an agenda/structure. </div><div><br></div><div>John</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Oct 5, 2021 at 3:13 AM Gail Hodges via Openid-specs-ekyc-ida <<a href="mailto:openid-specs-ekyc-ida@lists.openid.net">openid-specs-ekyc-ida@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="gmail-m_2721292580538409712WordSection1">
<p class="MsoNormal">+ Mike L<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Hi John<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">As Exec Director of the OIDF I’d just like to echo Mark’s comments – we warmly welcome exploration of OIDF standards to support entities seeking to comply with their CCPA/GDPR obligations.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">eKYC & IDA WG is indeed the best place to start the conversation, and discuss the use case in more detail. Time is weekly 8am PT/ 11am ET every Wednesday, hosted by Mark Haine. Attendees can also speak to the related standards, OpenID Connect
& FAPI. The only requirement to participate in the WG conversation is to sign the IPR contribution agreement, since we are an open standards body. Since you are working on open standards as well that should not be any impediment. <a href="https://openid.net/wg/ekyc-ida/" target="_blank">https://openid.net/wg/ekyc-ida/</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">As a personal note, I have thought that the standards underway in OIDF (and separately those on mobile driving licenses in ISO18013-5) could help achieve compliance & conformance to CCPA & GDPR, and partnership with your group could help
accelerate that timetable. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Just let me know if you prefer a “side huddle” pre or post the eKYC WG conversation, I’m happy to help organize.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Gail <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span lang="EN-GB" style="font-size:12pt;color:black">From:
</span></b><span lang="EN-GB" style="font-size:12pt;color:black">Openid-specs-ekyc-ida <<a href="mailto:openid-specs-ekyc-ida-bounces@lists.openid.net" target="_blank">openid-specs-ekyc-ida-bounces@lists.openid.net</a>> on behalf of Mark Haine via Openid-specs-ekyc-ida <<a href="mailto:openid-specs-ekyc-ida@lists.openid.net" target="_blank">openid-specs-ekyc-ida@lists.openid.net</a>><br>
<b>Reply-To: </b>OpenID eKYC Identity Assurance Working Group <<a href="mailto:openid-specs-ekyc-ida@lists.openid.net" target="_blank">openid-specs-ekyc-ida@lists.openid.net</a>><br>
<b>Date: </b>Monday, October 4, 2021 at 2:39 AM<br>
<b>To: </b>Dazza Greenwood <<a href="mailto:dazza.greenwood.consultant@consumer.org" target="_blank">dazza.greenwood.consultant@consumer.org</a>>, Ryan Rix <<a href="mailto:ryan.rix.consultant@consumer.org" target="_blank">ryan.rix.consultant@consumer.org</a>>, Marc Llahona <<a href="mailto:marc@datagrail.io" target="_blank">marc@datagrail.io</a>>, John Gronberg <<a href="mailto:gronberg@datagrail.io" target="_blank">gronberg@datagrail.io</a>><br>
<b>Cc: </b>Mark Haine <mark@considrd.consulting>, OpenID eKYC Identity Assurance Working Group <<a href="mailto:openid-specs-ekyc-ida@lists.openid.net" target="_blank">openid-specs-ekyc-ida@lists.openid.net</a>><br>
<b>Subject: </b>Re: [OpenID-Specs-eKYC-IDA] Data Rights Protocol and eKYC<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
</div>
<p class="MsoNormal"><span lang="EN-GB">Hi John,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Thanks so much for your mail and for bring this topic to the group. In the first instance it would be great if you or colleagues could attend one of our working group meetings and introduce yourselves, you would be very
welcome. We are active in finding real world use cases to test the base hypothesis of our work and it sounds like this is one that we haven’t imagined as yet.
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">I personally find this use case really interesting and have done a little thinking around something that might be quite similar and looks to address the lack of a standardised interface for Data Subject Requests although
I hadn’t got to the point of specifying an interface.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">With regards to your questions I shall have a go but these are not authoritative answers from the WG! I also hope that I have understood your questions well enough.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">1 – trust model – The OIDF focusses on tools not rules and as such we do not attend to the trust model side of things as that is in the policy domain rather than the technology domain. We have a partner organisation
called the Open Identity Exchange that has been working on a definition of the component parts of a trust framework that you may find quite useful.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">2 – Workflow for claims – I am not sure I understand this question properly but we do have an open issue that relates to how the spec might be able to handle request for claims that need to be established through a more
time consuming process than claims that are readily available to the PIP<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">3 – API Authorisation – I expect so<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">4 – other concerns – Have you looked at the security profile work coming out of the FAPI working group? We would encourage use of FAPI to mitigate security risks when using OIDC for IDA with any sensitive information
or PII.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Mark Haine<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:black">OpenID Foundation eKYC & IDA Working Group Co-chair<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:black">+44 (0) 777 555 0344 | <a href="mailto:mark@considrd.consulting" title="mailto:mark@considrd.consulting" target="_blank"><span style="color:rgb(5,99,193)">mark@considrd.consulting</span></a> | <a href="https://www.considrd.consulting/" target="_blank"><span style="color:rgb(5,99,193)">considrd.consulting</span></a> | </span><span lang="EN-GB" style="color:black">30
The Grange, Irvine. KA11 2EU</span><span lang="EN-GB" style="font-size:12pt;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:12pt;color:black"><img border="0" width="98" height="42" style="width: 1.0208in; height: 0.4375in;" id="gmail-m_2721292580538409712Picture_x0020_3" src="cid:17c71b3ff9e4cff311" alt="considrd.consulting logo"></span><span lang="EN-GB"><a href="https://www.considrd.consulting/" target="_blank"><span style="color:windowtext;text-decoration:none"><span style="font-size:12pt;color:black"><img border="0" width="136" height="53" style="width: 1.4166in; height: 0.552in;" id="gmail-m_2721292580538409712Picture_x0020_2" src="cid:17c71b3ffa35b16b22" alt="OpenID Logo"></span></span></a><span style="color:black"><img border="0" width="83" height="35" style="width: 0.8645in; height: 0.3645in;" id="gmail-m_2721292580538409712Picture_x0020_1" src="cid:17c71b3ffa4692e333" alt="signature_900739338"></span></span><span lang="EN-GB" style="font-size:12pt;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:black"> </span><span lang="EN-GB" style="font-size:12pt;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"> <u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span lang="EN-GB" style="font-size:12pt;color:black">From:
</span></b><span lang="EN-GB" style="font-size:12pt;color:black">Openid-specs-ekyc-ida <<a href="mailto:openid-specs-ekyc-ida-bounces@lists.openid.net" target="_blank">openid-specs-ekyc-ida-bounces@lists.openid.net</a>> on behalf of John Gronberg via Openid-specs-ekyc-ida <<a href="mailto:openid-specs-ekyc-ida@lists.openid.net" target="_blank">openid-specs-ekyc-ida@lists.openid.net</a>><br>
<b>Reply to: </b>OpenID eKYC Identity Assurance Working Group <<a href="mailto:openid-specs-ekyc-ida@lists.openid.net" target="_blank">openid-specs-ekyc-ida@lists.openid.net</a>><br>
<b>Date: </b>Friday, 1 October 2021 at 19:28<br>
<b>To: </b>"<a href="mailto:openid-specs-ekyc-ida@lists.openid.net" target="_blank">openid-specs-ekyc-ida@lists.openid.net</a>" <<a href="mailto:openid-specs-ekyc-ida@lists.openid.net" target="_blank">openid-specs-ekyc-ida@lists.openid.net</a>>, Dazza Greenwood <<a href="mailto:dazza.greenwood.consultant@consumer.org" target="_blank">dazza.greenwood.consultant@consumer.org</a>>, Ryan Rix <<a href="mailto:ryan.rix.consultant@consumer.org" target="_blank">ryan.rix.consultant@consumer.org</a>>, Marc Llahona <<a href="mailto:marc@datagrail.io" target="_blank">marc@datagrail.io</a>><br>
<b>Cc: </b>John Gronberg <<a href="mailto:gronberg@datagrail.io" target="_blank">gronberg@datagrail.io</a>><br>
<b>Subject: </b>[OpenID-Specs-eKYC-IDA] Data Rights Protocol and eKYC<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
</div>
<div>
<div>
<p style="margin:0in"><span lang="EN-GB" style="font-family:Arial,sans-serif">Hello eKYC WG,</span><span lang="EN-GB"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p style="margin:0in"><span lang="EN-GB" style="font-family:Arial,sans-serif">I'm part of a consortium of privacy infrastructure and technology businesses working to create an open standard for Data Subject Rights (DSR) Requests for businesses under the jurisdiction
of the CCPA. You can read a little bit more about the protocol here: </span><span lang="EN-GB"><a href="http://datarightsprotocol.org" target="_blank"><span style="font-family:Arial,sans-serif">http://datarightsprotocol.org</span></a></span><span lang="EN-GB" style="font-family:Arial,sans-serif"> </span><span lang="EN-GB"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p style="margin:0in"><i><span lang="EN-GB" style="font-family:Arial,sans-serif">"This specification defines a web protocol encoding a set of standardized request/response data flows such that End-Users can exercise Personal Data Rights provided under regulations
like the California Consumer Privacy Act, General Data Protection Regulation, and other regulatory or voluntary bases, and receive affirmative responses in standardized formats.</span></i><span lang="EN-GB"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p style="margin:0in"><i><span lang="EN-GB" style="font-family:Arial,sans-serif">We aim to make the data rights protocol integrable with an ecosystem of data rights middlewares, agent services, automation tool kits, and privacy-respecting businesses which
empower and build trust with consumers while driving the cost of compliance towards zero."</span></i><span lang="EN-GB"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p style="margin:0in"><span lang="EN-GB" style="font-family:Arial,sans-serif">We believe that the eKYC extension to OIDC would be a good fit for our use case. I will lay out the scenario below</span><span lang="EN-GB"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p style="margin:0in"><span lang="EN-GB" style="font-family:Arial,sans-serif">These are the relevant entities:</span><span lang="EN-GB"><u></u><u></u></span></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoNormal" style="margin-top:10pt;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal">
<span lang="EN-GB" style="font-family:Arial,sans-serif">a <b>data subject</b>: A natural person about whom a controller holds personal data and who can be identified, directly or indirectly, by reference to that personal data<u></u><u></u></span></li><li class="MsoNormal" style="vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal">
<span lang="EN-GB" style="font-family:Arial,sans-serif">an <b>authorized agent</b>: A third party designated by a Consumer to perform Data Subject Requests on their behalf. This would be like a user agent/app.<u></u><u></u></span></li><li class="MsoNormal" style="vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal">
<span lang="EN-GB" style="font-family:Arial,sans-serif">a <b>Privacy Infrastructure Provider (PIP)</b>: a technology solution that can orchestrate a DSR request for a business. <u></u><u></u></span></li><li class="MsoNormal" style="margin-bottom:10pt;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal">
<b><span lang="EN-GB" style="font-family:Arial,sans-serif">a covered business</span></b><span lang="EN-GB" style="font-family:Arial,sans-serif">: A natural or legal person, public authority, agency or other body which, alone or jointly with others, determines
the purposes and means of the processing of personal data and is subject to the CCPA.<u></u><u></u></span></li></ul>
<p style="margin:0in"><span lang="EN-GB" style="font-family:Arial,sans-serif">A data subject will initiate one or more data subject requests through an authorized agent. The authorized agent will create these requests with one or more covered businesses.
The covered business will have certain requirements in place for establishing the identity of the data subject. Once the requirements are met, the businesses will process the rights requests (for erasure, access, etc) based on their internal processes, or
the PIP will do so on behalf of the covered business. Upon completion of the internal processes, the results of the rights request will be returned to the authorized agent for delivery to the data subject. </span><span lang="EN-GB"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p style="margin:0in"><span lang="EN-GB" style="font-family:Arial,sans-serif">We're trying to answer the following questions:</span><span lang="EN-GB"><u></u><u></u></span></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoNormal" style="margin-top:10pt;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal">
<span lang="EN-GB" style="font-family:Arial,sans-serif">Identity claims could be supplied by the authorized agent or the PIP/covered business. What is the proper trust model and how can we establish confidence in the claims? <u></u><u></u></span></li><li class="MsoNormal" style="vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal">
<span lang="EN-GB" style="font-family:Arial,sans-serif">The PIP/covered business may need to get identity claims that the authorized agent does not yet have (for instance, if the covered business is an ecommerce company it may want to know the date of the
last order placed by the data subject). What is the right model for us to establish such claims?<u></u><u></u></span></li><li class="MsoNormal" style="vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal">
<span lang="EN-GB" style="font-family:Arial,sans-serif">Presumably, for the API authorization that would go along with the identity claims, we would be able to use the standard OIDC flow with the PIP/covered business acting as the authorization server and
the authorized agent acting as a user agent, correct?<u></u><u></u></span></li><li class="MsoNormal" style="margin-bottom:10pt;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal">
<span lang="EN-GB" style="font-family:Arial,sans-serif">Do you have any concerns or other questions as we figure out how to meet our DSR use cases with OIDC? <u></u><u></u></span></li></ol>
<p style="margin:0in"><span lang="EN-GB" style="font-family:Arial,sans-serif">We've put together a few explanatory diagrams in
</span><span lang="EN-GB"><a href="https://github.com/consumer-reports-digital-lab/data-rights-protocol/blob/main/files/eKYC-WG-feedback.pdf" target="_blank"><span style="font-family:Arial,sans-serif">this document</span></a></span><span lang="EN-GB" style="font-family:Arial,sans-serif">
for further explanation. </span><span lang="EN-GB"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p style="margin:0in"><span lang="EN-GB" style="font-family:Arial,sans-serif">We're looking forward to your input! I will be unavailable via email for the next week, but will respond to comments upon my return.</span><span lang="EN-GB"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p style="margin:0in"><span lang="EN-GB" style="font-family:Arial,sans-serif">Cheers,</span><span lang="EN-GB"><u></u><u></u></span></p>
<p style="margin:0in"><span lang="EN-GB" style="font-family:Arial,sans-serif">John</span><span lang="EN-GB"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
</div>
</div>
</div>
</div>
-- <br>
Openid-specs-ekyc-ida mailing list<br>
<a href="mailto:Openid-specs-ekyc-ida@lists.openid.net" target="_blank">Openid-specs-ekyc-ida@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ekyc-ida" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ekyc-ida</a><br>
</blockquote></div>