From IIW
Jump to: navigation, search

How The GDPR Is Making Me TRACK MORE

Wednesday 4J

Convener: George Fletcher

Notes-taker(s): George Fletcher

Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps:

General discussion about GDPR requirements (not exhaustive)

  • User ability to…
      • Request what is being tracked
      • Download data the company has on me
      • Update some data elements (if they are incorrect)
      • Delete all my data
    • Clear and informed consent
    • Requirement to report data tracked by device identifier and not directly tied to a user (e.g. persistent browser cookie)
  • The issue of concern. If we have to give out tracked data based on device identifiers, how do we ensure that data is only given to the correct entity
    • low confidence — device reports the identifiers to the host
      • no way to verify that the identifiers the device is claiming is “theirs” are really valid (i.e. the correct value and not impersonated/stolen)
    • medium confidence — possibly OAuth2 dynamical client reg with pub/priv keys, apps report identifiers in a JWS (signed JSON Web Token) on a periodic basis, host builds a risk-based profile of device **based on these signed assertions. At data request time match signed identifiers to risk-based profile to define a higher level of confidence
    • high confidence — didn’t discuss this much… probably requires special hardware on the device
  • Conclusion — in order to support safe release of data to a device identifier additional tracking must be done