User Object - Revision history

Tom: /* References */

2018-08-12T22:02:22Z

‎References

Tom: /* Data Flows Between User Objects */

2018-08-12T16:13:50Z

‎Data Flows Between User Objects

Tom: /* Solutions */

2018-08-12T16:10:54Z

‎Solutions

Tom: /* Solutions */

2018-08-12T16:10:25Z

‎Solutions

Tom: /* Solutions */

2018-08-12T16:07:56Z

‎Solutions

Tom: /* Solutions */

2018-08-12T16:07:22Z

‎Solutions

Tom: /* Solutions */

2018-08-12T16:06:30Z

‎Solutions

Tom: /* Solutions */

2018-08-12T16:06:08Z

‎Solutions

Tom: /* Solutions */

2018-08-12T16:05:44Z

‎Solutions

Tom: /* Controlling Data Flows */

2018-08-12T16:04:29Z

‎Controlling Data Flows

← Older revision		Revision as of 22:02, 12 August 2018
Line 39:		Line 39:
	[[Category:Glossary]]		[[Category:Glossary]]
	[[Category:User Experience]]		[[Category:User Experience]]
		+	[[Category:Identity]]

@@ Line 30: / Line 30: @@
 [[File:UserObject.png]]
-The dashed lines show the flows controlled by the user. The Solid lines are not controlled by the user, nor are completely out-of-band flows. The user objects to the right are typically held in cookies in the user agent, which are not typically known to the user. Note that third parties (Advertisers in the image) do not explicitly get [[User Private Information]], rather they are given access to user cookie space by the other web sites in return for advertising prices they pay to those sites. They then use that access to create a user object of their own, both on their own web site as well as in the user cookie space. They can then use that data to track the user and target ads to the user based on past user behavior.
+The dashed lines show the flows controlled by the user. The Solid lines are not controlled by the user. Completely out-of-band flows should honor the [[User Intent]] in the ideal case, but have not been traditionally reported to the user. The user objects to the right are typically held in cookies in the user agent, which are not typically known to the user. Note that third parties (Advertisers in the image) do not explicitly get [[User Private Information]], rather they are given access to user cookie space by the other web sites in return for advertising prices they pay to those sites. They then use that access to create a user object of their own, both on their own web site as well as in the user cookie space. They can then use that data to track the user and target ads to the user based on past user behavior.
 ===Controlling Data Flows===

@@ Line 21: / Line 21: @@
 No matter how the [[User Object]] is realized, it is important the that user can understand what [[User Private Information]] is held by the [[Relying Party]] and what [[Redress]] the user has to change that information if user desires. In particular the terms that stipulate how the web site will handled the [[User Private Information]] is communicated to the user by some sort of [[Consent Receipt]] which might be as simple as a set of prescribed terms of the site's choosing (aka a Privacy Statement), or as complex as the [https://kantarainitiative.org/confluence/display/infosharing/Home Kantara Receipt].
-It is likely that databases controlled by entities will include other information that are covered by regulation. Although these data are not described in the work of the IDESG, they are still of concern to the users. The behavior patters of the user are an example of such information. Specifically the [Right to be Forgotten]] applies to past user behaviors such as legal actions and user actions which are ruled by courts to be excluded from internet accessible collections, even if those behaviors are a matter of public record and still internet accessible.
+It is likely that databases controlled by entities will include other information that are covered by regulation. Although these data are not described in the work of the IDESG, they are still of concern to the users. The behavior patters of the user are an example of such information. Specifically the [[Right to be Forgotten]] applies to past user behaviors such as legal actions and user actions which are ruled by courts to be excluded from internet accessible collections, even if those behaviors are a matter of public record and still internet accessible.
 Note that the [[User Agent]] is also a digital entity that has a User Object associated with it. This is mostly in the form of short lifetime packets of claims typically stored in cookies.

@@ Line 21: / Line 21: @@
 No matter how the [[User Object]] is realized, it is important the that user can understand what [[User Private Information]] is held by the [[Relying Party]] and what [[Redress]] the user has to change that information if user desires. In particular the terms that stipulate how the web site will handled the [[User Private Information]] is communicated to the user by some sort of [[Consent Receipt]] which might be as simple as a set of prescribed terms of the site's choosing (aka a Privacy Statement), or as complex as the [https://kantarainitiative.org/confluence/display/infosharing/Home Kantara Receipt].
-It is likely that databases controlled by entities will include other information that are covered by regulation. Although these data are not described in the work of the IDESG, they are still of concern to the users. The behavior patters of the user are an example of such information. Specifically the [https://en.wikipedia.org/wiki/Right_to_be_forgotten right to be forgotten] applies to past user behaviors such as legal actions and user actions which are ruled by courts to be excluded from internet accessible collections, even if those behaviors are a matter of public record and still internet accessible.
+It is likely that databases controlled by entities will include other information that are covered by regulation. Although these data are not described in the work of the IDESG, they are still of concern to the users. The behavior patters of the user are an example of such information. Specifically the [Right to be Forgotten]] applies to past user behaviors such as legal actions and user actions which are ruled by courts to be excluded from internet accessible collections, even if those behaviors are a matter of public record and still internet accessible.
 Note that the [[User Agent]] is also a digital entity that has a User Object associated with it. This is mostly in the form of short lifetime packets of claims typically stored in cookies.

@@ Line 19: / Line 19: @@
 Another instantiation of the user object might allow for attributes that are dynamically configured during a consent negotiation with the user. In this case one or more elements might be bundled into a claim received from another party, or data entered directly by the user, but with a set of stipulations on the use of that particular collection of data by the web site.
-No matter how the [[User Object]] is realized, it is important the that user can understand what [[User Private Information]] is held by the [[Relying Party]] and what redress the user has to change that information if user desires. In particular the terms that stipulate how the web site will handled the [[User Private Information]] is communicated to the user by some sort of [[Consent Receipt]] which might be as simple as a set of prescribed terms of the site's choosing (aka a Privacy Statement), or as complex as the [https://kantarainitiative.org/confluence/display/infosharing/Home Kantara Receipt].
+No matter how the [[User Object]] is realized, it is important the that user can understand what [[User Private Information]] is held by the [[Relying Party]] and what [[Redress]] the user has to change that information if user desires. In particular the terms that stipulate how the web site will handled the [[User Private Information]] is communicated to the user by some sort of [[Consent Receipt]] which might be as simple as a set of prescribed terms of the site's choosing (aka a Privacy Statement), or as complex as the [https://kantarainitiative.org/confluence/display/infosharing/Home Kantara Receipt].
 It is likely that databases controlled by entities will include other information that are covered by regulation. Although these data are not described in the work of the IDESG, they are still of concern to the users. The behavior patters of the user are an example of such information. Specifically the [https://en.wikipedia.org/wiki/Right_to_be_forgotten right to be forgotten] applies to past user behaviors such as legal actions and user actions which are ruled by courts to be excluded from internet accessible collections, even if those behaviors are a matter of public record and still internet accessible.

@@ Line 15: / Line 15: @@
 ==Solutions==
-One instantiation of the user object in a relying party is described in the [[Best Practices and Example Relying Party]]. That example describes the user object as a collection of tables in a SQL data schema. Note that the [[User Object]] consists of [[User Private Information]] plus linkages and status information that are internal to the relying party. In this instantiation all attributes in the data base have a static tag indicating how the user interaction with that attribute is permitted.
+One instantiation of the user object in a relying party is described in the [[Best Practice and Example Relying Party]]. That example describes the user object as a collection of tables in a SQL data schema. Note that the [[User Object]] consists of [[User Private Information]] plus linkages and status information that are internal to the relying party. In this instantiation all attributes in the data base have a static tag indicating how the user interaction with that attribute is permitted.
 Another instantiation of the user object might allow for attributes that are dynamically configured during a consent negotiation with the user. In this case one or more elements might be bundled into a claim received from another party, or data entered directly by the user, but with a set of stipulations on the use of that particular collection of data by the web site.

@@ Line 33: / Line 33: @@
 ===Controlling Data Flows===
-[[Information Sharing]] is the name used for one [[Data Controller]] (aka [[Web Site]] with a [[User Object]]) sharing data with another. that is where the [[GDPR]] focuses its attention. It completely ignores the problem that the [[Data Controller]] might not have had a good reason to collect the data in the first place, or even force it to prove [[User Intent]] in acquiring that information. No relief is provided for the misuse of [[User Private Information]] with existing regulations. They focus on the sharing aspect completely. See the page "[[GDPR is a scam]]" for details on that.
+[[Information Sharing]] is the name used for one [[Data Controller]] (aka [[Web Site]] with a [[User Object]]) sharing data with another. That is where the [[GDPR]] focuses its attention. It completely ignores the problem that the [[Data Controller]] might not have had a good reason to have collected the data in the first place, or even force it to prove [[User Intent]] in acquiring that information. No relief is provided for the misuse of [[User Private Information]] with existing regulations. They focus on the sharing aspect completely. See the page "[[GDPR is a scam]]" for details on that.
 ==References==