Difference between revisions of "Notice-centric ID"

From MgmtWiki
Jump to: navigation, search
(Created page with "==Full Title or Meme== The problem of giving notice to Subjects about issues is addressed before the user is asked to provide any personal information. ==Context== Noti...")
 
(→‎Context)
Line 3: Line 3:
  
 
==Context==
 
==Context==
−
[[Notice]], like any access to user personal data requires access of the [[Subject]]'s endpoint address. The following paragraph 57 of the [[GDPR]] should help clarify this function.
+
It has become obvious that traditional methods of establishing identity have been forces on an Identifier Provider (IdP). This has created privacy and user tracking problems that have been difficult to mitigate. The most common method in 2020 is [[OpenID Connect]] using one of the social media sites like FaceBook or Google.
−
 
 
−
If the [[User Information]] processed by a [[Data Controller]] do not permit the controller to identify a natural person sufficiently well to provide the user with [[Notice]] of problems, the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation. However, the controller should not refuse to take additional information provided by the data subject in order to support the exercise of his or her rights. Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the [[Data Controller]].
 
  
 
==Problems==
 
==Problems==

Revision as of 15:58, 16 February 2021

Full Title or Meme

The problem of giving notice to Subjects about issues is addressed before the user is asked to provide any personal information.

Context

It has become obvious that traditional methods of establishing identity have been forces on an Identifier Provider (IdP). This has created privacy and user tracking problems that have been difficult to mitigate. The most common method in 2020 is OpenID Connect using one of the social media sites like FaceBook or Google.

Problems

  • In most cases where users want to get corrections applied to data held by a Data Controller, they are not the customer, they are the product. For example, the three credit bureaus make nearly all of their revenue from merchants that want to know if a user is trustworthy. The merchants and banks are the source of the data and its consumers as well; the user is just a inconvenience to them.
  • Many attempts have been initiated to provide User Notice, without having any effect on user's behavior, which seems to be conditioned to the current conditions of the web.

Solutions

  • Before Subjects can be given notice, some mechanisms must be put into place to allow the subject to seek Redress or corrections to the data in the User Objects held by the Data Controller.
  • One method for a web site to comply with Notice regulations is to create a Notice-centric ID. In this type of Identifier the issued to be addressed before the user is asked for personal data is for the notice channel to be established.

References


  • See the wiki page on User Consent which is a structure that tells the user what data is held. This receipt is the first effort at providing Open Notice capabilities to users.
Retrieved from "http://tcwiki.azurewebsites.net/index.php?title=Notice-centric_ID&oldid=9705"