Financial User Consent - Revision history

Tom: /* Context */

2024-09-13T23:18:28Z

‎Context

Tom: /* Problems */

2022-07-10T17:56:34Z

‎Problems

Tom: /* Other Sources */

2022-02-01T21:08:06Z

‎Other Sources

Tom: /* Other Sources */

2020-12-10T17:44:33Z

‎Other Sources

Tom: /* Problems */

2019-04-18T19:33:33Z

‎Problems

Tom: /* Problem */

2019-04-18T19:31:46Z

‎Problem

Tom: /* Back at the Relying Party */

2019-04-15T23:24:32Z

‎Back at the Relying Party

Tom: /* Consent Taxonomy */

2019-04-15T23:19:07Z

‎Consent Taxonomy

Tom: /* Context */

2019-04-15T23:15:02Z

‎Context

Tom: /* Possible Complexity of a Financial Transaction */

2019-04-15T23:11:17Z

‎Possible Complexity of a Financial Transaction

@@ Line 3: / Line 3: @@
 ==Context==
-This context is specific to this use case and may not apply in all legal jurisdictions. For example,not all legal jurisdictions agree that a holder of user assets has a fiduciary responsibility to the user.
+This context is specific to this use case and may not apply in all legal jurisdictions. For example,not all legal jurisdictions agree that a holder of user assets has a [[Fiduciary]] responsibility to the user.
 *This page is about the use case of a [[User]] on a [[User Agent]] authenticated by an [[Identifier or Attribute Provider]] (IAP) with two areas of consent:

@@ Line 15: / Line 15: @@
 ==Problems==
 *User consent is discussed in the [[GDPR]] for transfers of [[User Information]] between two [[Data Controller]]s on the internet. It is not clear if the [[GDPR]] or other privacy regulations apply to a transaction where an existing relationship exists between [[Data Controller]]s who then enter into a transaction that involves the exchange of money. Note that the details in the transaction may be very sensitive based on the contents of the item purchased.
-*Much of the current emphasis on technology improvement in financial transaction is the same change found already in technology improvement in existing industries, reduction in friction. But friction serves an important function where money in involved. For example in "the UK, the introduction of a Faster Payments Service (FPS) resulted in an unfortunate reality - faster fraud."<ref>Kristopher Rogers, ''The Future of Direct Debit: 2 key drivers for change in 2019.'' Split Payments (2019-04-01 -- Hmm, I guess he really means it?0 https://www.linkedin.com/pulse/future-direct-debit-2-key-drivers-change-2019-kristofer-rogers/</ref> Somehow the current [[Open Banking]] effort there seems to believe that they can solve this problem. That remains to be seen.
+*Much of the current emphasis on technology improvement in financial transaction is the same change found already in technology improvement in existing industries, reduction in [[Friction]]. But [[Friction]] serves an important function where money in involved. For example, in "the UK, the introduction of a Faster Payments Service (FPS) resulted in an unfortunate reality - faster fraud."<ref>Kristopher Rogers, ''The Future of Direct Debit: 2 key drivers for change in 2019.'' Split Payments (2019-04-01 -- Hmm, I guess he really means it?0 https://www.linkedin.com/pulse/future-direct-debit-2-key-drivers-change-2019-kristofer-rogers/</ref> Somehow the current [[Open Banking]] effort there seems to believe that they can solve this problem. That remains to be seen.
 ==Solution==

@@ Line 57: / Line 57: @@
 * [https://www.notion.so/Knowledge-Base-78ccd4e0d1144e3e9ca76b7b1345a0c1 Use of SSI in Financial Transactions]
-[[Category:Glossary]]
+[[Category: Glossary]]
-[[Category:Privacy]]
+[[Category: Privacy]]
-[[Category:Consent]]
+[[Category: Consent]]
-[[Category:Use Case]]
+[[Category: User Experience]]

@@ Line 55: / Line 55: @@
 *[https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_omc_201805/ Guidelines for obtaining meaningful consent] from Office of the Privacy Commissioner of Canada which began to apply these guidelines on January 1, 2019.
 *[http://www.meaningfulconsent.org/ Meaningful Consent in the Digital Economy] (MCDE) is an EPSRC-funded research project that is examining issues related to giving and obtaining user consent online.
 [[Category:Glossary]]

@@ Line 15: / Line 15: @@
 ==Problems==
 *User consent is discussed in the [[GDPR]] for transfers of [[User Information]] between two [[Data Controller]]s on the internet. It is not clear if the [[GDPR]] or other privacy regulations apply to a transaction where an existing relationship exists between [[Data Controller]]s who then enter into a transaction that involves the exchange of money. Note that the details in the transaction may be very sensitive based on the contents of the item purchased.
-*Much of the current emphasis on technology improvement in financial transaction is the same change found already in technology improvement in existing industries, reduction in friction. But friction serves an important function where money in involved. For example in "the UK, the introduction of a Faster Payments Service (FPS) resulted in an unfortunate reality - faster fraud."<ref>Kristopher Rogers, ''The Future of Direct Debit: 2 key drivers for change in 2019.'' Split Payments (2019-04-01 -- Hmm, I guess he really means it?0 https://www.linkedin.com/pulse/future-direct-debit-2-key-drivers-change-2019-kristofer-rogers/
+*Much of the current emphasis on technology improvement in financial transaction is the same change found already in technology improvement in existing industries, reduction in friction. But friction serves an important function where money in involved. For example in "the UK, the introduction of a Faster Payments Service (FPS) resulted in an unfortunate reality - faster fraud."<ref>Kristopher Rogers, ''The Future of Direct Debit: 2 key drivers for change in 2019.'' Split Payments (2019-04-01 -- Hmm, I guess he really means it?0 https://www.linkedin.com/pulse/future-direct-debit-2-key-drivers-change-2019-kristofer-rogers/</ref> Somehow the current [[Open Banking]] effort there seems to believe that they can solve this problem. That remains to be seen.
 ==Solution==

@@ Line 28: / Line 28: @@
 *The [[User Consent]] provided might not align exactly with what the RP requested. In that case the RP may accept the consent granted, or it may need to go back to the user for additional [[Attribute]]s or some [[Validated|Validation]] of the [[Attribute]]s. It is important at this point to know if the session with the IAP is still valid, or if a new session would be initiated. The [[User Experience]] should be maximized whichever path is chosen.
 *The [[Relying Party]] may be a Payment Initiator, or may use some other service for that function.
-*Only the [[Relying Party]] may set the conditions that it needs for compliance in its legal jurisdictions, wo it must have the means to express the consent conditions that are required of the user. In a hyper connected environment there may be as many jurisdictions as there are parties. Consider the following all to real path.
+*Only the [[Relying Party]] may set the conditions that it needs for compliance in its legal jurisdictions; so it must have the means to express the consent conditions that are required of the user. In a hyper connected environment there may be as many jurisdictions as there are parties. Consider the following all to real path.
 ===Possible Complexity of a Financial Transaction===

@@ Line 44: / Line 44: @@
 ===Consent Taxonomy===
-* For the semi-static information the user must be shown a list of categories of [[User Private Information]] one the wiki page [[User Consent#Consent Taxonomy]]] start with a [https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims list] of [[OpenID Connect]] [[Scope]]s and move on from there. This is typically user [[Attribute]]s.
+* For the semi-static [[Attribute]] information the user must be shown a list of categories of [[User Private Information]] one the wiki page [[User Consent#Consent Taxonomy]]] start with a [https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims list] of [[OpenID Connect]] [[Scope]]s and move on from there. This is typically user [[Attribute]]s.
 * For the transactional information the user must know what value is being transfered, both in terms of the money (or other value tokens) sent in one direction and the goods or services sent in exchange for that money. This transaction typically exposes user [[Behavior]], which can still be very personal especially if the goods or services are related to health care issues.

@@ Line 11: / Line 11: @@
 *User Consent to release information may be cached by the IAP with permission from the user which does not alter a requirement to notify the user of release of information.
 *User Consent to release money (or other assets) by likewise be cached by a Payment Initiation Service Provider (PISP) which does not alter a requirement to notify the user of release of funds.
 ==Problem==

@@ Line 40: / Line 40: @@
 The real reason for showing the potential complexity of financial transaction in a fully disbursed regulatory environment, is that some entity must be tasked with getting user consent. In my understanding of the reality of this transaction, only Amazon US has sufficient detail to determine which legal jurisdiction(s) apply and must be the [[Entity]] to establish the consent regime.
-Note that in the US today there are many new payment initiators (like square) that result in a posting on the user account statement this is pretty much complete gibberish. Some banks in the US have resorted to AI as a service to the users to try to disambiguate the transaction record. That case may be happening soon with the transaction records in Europe. It should be clear that a little foresight can help to establish the appropriate [[Entity]] based on the knowledge that they have of the complete transaction. That [[Entity]] should be the one to craft the notification record for the user as well.
+Note that in the US today there are many new payment initiators (like square) that result in a posting on the user account statement that is pretty much complete gibberish. Some banks in the US have resorted to AI as a service to the users to try to disambiguate the transaction record. That case may be happening soon with the transaction records in Europe. It should be clear that a little foresight can help to establish the appropriate [[Entity]] based on the knowledge that they have of the complete transaction. That [[Entity]] should be the one to craft the notification record for the user as well. In any case the contemporaneous notification to the user really should match the record that appears on the user's monthly statement.
 ===Consent Taxonomy===