5Radical Ways to Keep Vendors Accountable for Your Data!!! Kantara Consent Receipt

5 Radical Ways to Keep Vendors Accountable for Your Data!! Kantara Consent Receipt: Personal Data Receipt

Tuesday 5C

Convener: Andrew Hughes, contributor, Kantara Initiative, AndrewHughes3000@gmail.com

Notes-taker(s): Scott Mace

Tags for the session - technology discussed/ideas considered:

Consent receipts

Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps:

@idimandrew

Personal data receipt a.k.a. consent receipt

What is missing?

No one is going to read the terms of service, but what if there is a problem.

What’s missing is a record the person can keep independent of the records of the vendor with details that can hold the vendor accountable. In sales, it’s called a receipt. Date & time stamps, location, maybe ID of you through credit card data. And the price. Why are those thing useful. Returns. Insurance. Tax deductions.

You buy something and also they ask for your mother’s maiden name for some reason that seems reasonable. What if they say instead, allow us to use your precise location to find a store near you.

In Kantara, consent receipt spec 1.1 published in February 2018. Downloadable. Just a data structure. At the time it was developed, privacy people involved saw GDPR coming down. We had an estimated target date for that, 2018. Prevailing view was consent would be huge. Puts the person in charge. The companies have to do what you say. Made it unusable for any enterprise anywhere. You have to provably say this is all the stuff. The advertising industry, it was required. May 25, 2018 arrived, and nobody does consent. It’s not a good idea if you’re a business to commit yourself to that level of responsiveness to your customers.

Q: So they took a reactive approach?

Those chose a different basis for processing data. Consent was one. Contract. Legitimate interest of the processor. Did what their lawyers told them to. If they had a contractual arrangement anyway, they continued doing that. Consent is a bad word when talking to everyone other than privacy advocates because nobody knows what you’re talking about. A word in English that has no bearing at all to the word in technology. Do you call the OAuth screen the consent screen? No. It’s the authorization screen. When people say consent, they mean permission and authorization.

Service provider develops a service, a person discovers the service, wants to use it, service provider offers terms, person considers terms, accept?, could be no. If yes, person and service provider jointly establish an agreement. Service provider performs record keeping. And person gets a sales receipt. The agreement also triggers payment & “consideration” by the service provider (the product or service).

Proposing the vendor optionally offers a receipt, and puts it in a storage place of the person’s choosing. Will demo at European identity conference in two weeks. Nickname is Smoke & Mirrors. The Kantara Privacy Control Panel. A control panel for your privacy. Fictional products. Intended to show interoperability of receipts. A stack of receipts. “Hey Alexa, analyze my receipts.” Tells you company is being fined for bad data practices. Might want to revoke that permission to provide data.

Could be applied to the IAB Transparency Consent Framework.

I dare you to think of any use case that does not fit this pattern.

Jim Pasquale: What if you neither say yes nor no, but counter-offer.

Wendell: The terms of the hot dogs are fairly clear. When you go buy other things, they come with a bundle of rights. You don’t have the right to rip off that design. If I “buy” a song, you’re not buying the song but a single-person performance right. That’s where the terms get horrendous.

Andrew: We’re building version 2. Kantara Initiative have a liaison with ISO Subcommittee 27 working group 5 concerned with identity technology & standards. Because of our liason, we have an opportunity to contribute the first draft of what we hope will define online consent records and receipts.