Consent Grant - Revision history

Tomjones: /* Actors */

2020-07-25T17:33:49Z

Actors

← Older revision		Revision as of 17:33, 25 July 2020
Line 12:		Line 12:

	===Actors===		===Actors===
	* The user, also call a resource owner, that has personal resources that can be conditionally shared with authorized web sites.		* The user, also call a resource owner (RO), that has personal resources that can be conditionally shared with authorized web sites.
	* A valuable Resource that is hosted on a Resource Server (RS). (Typically data, but it could also be a service API.)		* A valuable Resource that is hosted on a Resource Server (RS). (Typically data, but it could also be a service API.)
	* The Relying Party (RP) that requests access to the Resource from the user.		* The Relying Party (RP) that requests access to the Resource from the user.

2020-07-25T17:31:19Z

References

← Older revision		Revision as of 17:31, 25 July 2020
Line 46:		Line 46:

	==References==		==References==
			* See also wiki page on [[User Consent]].
	* See also the wiki page on [[Delegation]].		* See also the wiki page on [[Delegation]].
	* See also wiki page on [[Consent Receipt]].		* See also wiki page on [[Consent Receipt]].

2020-07-25T17:29:30Z

References

← Older revision		Revision as of 17:29, 25 July 2020
Line 47:		Line 47:
	==References==		==References==
	* See also the wiki page on [[Delegation]].		* See also the wiki page on [[Delegation]].
			* See also wiki page on [[Consent Receipt]].
	* From Nat's 2020-07-27 presentation to Identivers: (with apologies to Glenn Gould)		* From Nat's 2020-07-27 presentation to Identivers: (with apologies to Glenn Gould)
	''So you want to base on Consent?''		''So you want to base on Consent?''
Line 56:		Line 57:

	This session will briefly touch on other lawful bases and what is needed for potentially valid consent, then goes on to explain the requirements for privacy notice and consent process set out in “ISO/IEC 29184 Online privacy notices and consent”.		This session will briefly touch on other lawful bases and what is needed for potentially valid consent, then goes on to explain the requirements for privacy notice and consent process set out in “ISO/IEC 29184 Online privacy notices and consent”.

			[[Category:Consent]]
			[[Category:Standards]]
			[[Category:User Experience]]

2020-07-25T16:44:16Z

References

← Older revision		Revision as of 16:44, 25 July 2020
Line 46:		Line 46:

	==References==		==References==
			* See also the wiki page on [[Delegation]].
	* From Nat's 2020-07-27 presentation to Identivers: (with apologies to Glenn Gould)		* From Nat's 2020-07-27 presentation to Identivers: (with apologies to Glenn Gould)
	''So you want to base on Consent?''		''So you want to base on Consent?''

2020-07-25T16:43:00Z

Solutions

← Older revision		Revision as of 16:43, 25 July 2020
Line 35:		Line 35:
	\|-		\|-
	\|stipulation \|\| structure\|\|limits the scope of the grant \|\|MAY		\|stipulation \|\| structure\|\|limits the scope of the grant \|\|MAY
			\|-
			\|exp \|\| Unix epoch date\|\|when consent expires \|\|MAY
	\|-		\|-
	\|jwk \|\| key of the sub (the signer)\|\|include by value or by ref \|\|MAY		\|jwk \|\| key of the sub (the signer)\|\|include by value or by ref \|\|MAY

2020-07-25T16:38:09Z

Solutions

← Older revision		Revision as of 16:38, 25 July 2020
Line 30:		Line 30:
	\|puid \|\| Persistent Identifier of RO \|\| to handle recovery operation\|\|MAY		\|puid \|\| Persistent Identifier of RO \|\| to handle recovery operation\|\|MAY
	\|-		\|-
	\|aud \|\| Identifier of the resource server \|\| ~~Must~~ be ~~link~~ to ~~a decryption key~~\|\|MUST		\|aud \|\| Identifier of the resource server \|\| Might be just a reference to data in an enclosing identity token \|\|MUST
	\|-		\|-
	\|scope\|\| Identifier of the resource to be shared\|\| array\|\|MAY		\|scope\|\| Identifier of the resource to be shared\|\| array\|\|MAY

2020-07-25T16:33:08Z

Actors

← Older revision		Revision as of 16:33, 25 July 2020
Line 12:		Line 12:

	===Actors===		===Actors===
			* The user, also call a resource owner, that has personal resources that can be conditionally shared with authorized web sites.
	* A valuable Resource that is hosted on a Resource Server (RS). (Typically data, but it could also be a service API.)		* A valuable Resource that is hosted on a Resource Server (RS). (Typically data, but it could also be a service API.)
	* The Relying Party (RP) that requests access to the Resource from the user.		* The Relying Party (RP) that requests access to the Resource from the user.

2020-07-25T16:30:59Z

Solutions

← Older revision		Revision as of 16:30, 25 July 2020
Line 28:		Line 28:
	\|-		\|-
	\|puid \|\| Persistent Identifier of RO \|\| to handle recovery operation\|\|MAY		\|puid \|\| Persistent Identifier of RO \|\| to handle recovery operation\|\|MAY
	\|-
	~~\|user \|\| Identifier of the recipient of this grant \|\| Must be link to a signing key\|\|MUST~~
	\|-		\|-
	\|aud \|\| Identifier of the resource server \|\| Must be link to a decryption key\|\|MUST		\|aud \|\| Identifier of the resource server \|\| Must be link to a decryption key\|\|MUST

2020-07-25T16:29:59Z

Context

← Older revision		Revision as of 16:29, 25 July 2020
Line 5:		Line 5:
	* The wiki page is focused on the need for a user on the web to give some other party the ability to acquire access to their personal attributes.		* The wiki page is focused on the need for a user on the web to give some other party the ability to acquire access to their personal attributes.
	* Some examples of [[Consent Grant]] include:		* Some examples of [[Consent Grant]] include:
	**		# The system creates consent grant record - the person gets a receipt
			# The person creates the consent grant record, the systems gets the receipt
			# 3rd party gets the consent grant and gives both parties a receipt
	===Use Cases===		===Use Cases===
	* TK		* TK

2020-07-25T16:27:03Z

References

← Older revision		Revision as of 16:27, 25 July 2020
Line 43:		Line 43:

	==References==		==References==
	* From Nat's presentation to Identivers: (with apologies to Glenn Gould)		* From Nat's 2020-07-27 presentation to Identivers: (with apologies to Glenn Gould)
	''So you want to base on Consent?''		''So you want to base on Consent?''
	''You've got the urge to base on Consent,''		''You've got the urge to base on Consent,''
	''You've got the nerve to base on Consent,''		''You've got the nerve to base on Consent,''
	''So go ahead.''		''So go ahead.''

			Many people seem to believe that having their customers pressing “Agree” button is good enough to collect their “consent”. That’s actually not the case. Obtaining privacy consent has very high bar partly because that is the exception mechanism that you can resort to only when other lawful bases for the processing of personal data does not work.

			This session will briefly touch on other lawful bases and what is needed for potentially valid consent, then goes on to explain the requirements for privacy notice and consent process set out in “ISO/IEC 29184 Online privacy notices and consent”.