[WG-InfoSharing] Proposal for consent receipt demo

Oscar Santolalla Oscar.Santolalla at ubisecure.com
Thu Mar 28 12:40:26 UTC 2019

Hi all,

We have a proposal for next consent receipt demo (EIC 2019), and would like
to discuss it at today's call:





In the initial Consent Receipt demonstration (2018), the generated consent
receipt was downloaded to the browser of the end user. The consent receipt
viewer would read the consent receipt uploaded via the browser.


For the next demonstration, one of the goals is to show that the generated
consent receipt can be transferred directly to a third-party service of the
customer's choice, potentially the customer's own service. This allows the
end users consents to stored securely across devices.


To implement this, the party generating the consent receipt needs to get an
API endpoint and adequate permissions to write a consent a receipt on behalf
of the user.


To do this, we propose the user chooses their consent receipt service
(a.k.a. Privacy Control Panel) at the point of giving consent. The user's
consent receipt service will grant an OAuth2 access token to the web service
generating consent receipts in order to enable storage. A refresh token
could be granted to enable the end user to authorize the web service to
store future consent receipts in their chose Privacy Control Panel.


Discovery of the user's Privacy Control Panel is outside of the scope of the
demonstration. For the demonstration 2 or 3 options will be shown to
simulate the fact that multiple Privacy Control Panel can and will exist. It
could be imagined that these could be implemented using various techniques,
including but not limited to consumer facing web-based services, implemented
by browsers or browser plugins or handled by an operating system level


The Privacy Control Panel service would publish an endpoint for receiving
consent receipts in an appropriate standard service discovery technique
(e.g. OIDC Discovery protocol at well-known location?).







Best regards,




Sales Engineer - Ubisecure Inc

M: +358 400138272
 <mailto:oscar.santolalla at ubisecure.com> oscar.santolalla at ubisecure.com  |
<https://www.ubisecure.com/> https://www.ubisecure.com/ 

 <http://www.twitter.com/ubisecure> Twitter  |
<https://www.linkedin.com/company/ubisecure> LinkedIn 

Connecting Identity. Transforming Digital Business.

Vaisalantie 2, FI- Espoo, 02130, Finland
LEI:  <https://www.gleif.org/lei/529900T8BM49AURSDO55> 529900T8BM49AURSDO55



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://kantarainitiative.org/pipermail/wg-infosharing/attachments/20190328/6ccaf50d/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 5443 bytes
Desc: not available
URL: <http://kantarainitiative.org/pipermail/wg-infosharing/attachments/20190328/6ccaf50d/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5573 bytes
Desc: not available
URL: <http://kantarainitiative.org/pipermail/wg-infosharing/attachments/20190328/6ccaf50d/attachment-0001.p7s>

More information about the WG-InfoSharing mailing list