Earlier this month at Internet Identity Workshop 40, Doc Searls and I presented an update on ‘My Terms’, aka IEEE7012. The standard itself is due to publish later this year; but the work is now sufficiently cooked that we are able to discuss our contributions. We can also look toward how the standard could be deployed at Customer Commons in a similar way to how Creative Commons enabled online copyright using a series of standard licences.
The Project Authorisation Request which kicked off the standard development process can be found here (https://standards.ieee.org/ieee/7012/7192/ ). It says….
This draft standard covers contractual interactions and agreements between individuals and the service providers they engage on a network, including websites. It describes how individuals, acting as first parties, can proffer their privacy requirements as contractual terms and arrive at agreements recorded and kept by both sides. These terms shall be chosen from a collection of standard-form agreements in a roster kept by an independent and neutral non-business entity. Computing devices and software performing as agents for both first and second parties shall engage using any protocol that serves the purpose. The first party shall point to a preferred agreement, or a set of agreements, from which the second party shall accept one. Party-to-party negotiations over terms in any of these contracts or other agreements are outside the scope of this standard. If both parties agree, the chosen contract or agreement shall be signed electronically by both parties or their agents, and a matching record shall be kept by both sides in a form that can be retrieved, audited, or disputed, if necessary, at some later time–and which is available to do so easily.
So what does that mean in practice?
As I see it, the My Terms approach can re-build how personal and related data is exchanged on The Internet using different assumptions to the current norm. That includes
- Customer Commons as the neutral place that can host human, legal and machine-readable standardised data sharing agreements
- IEEE7012 to specify and standardise the technical requirements that underpin data exchange when seen from the individual perspective
- Contract’ as the legal basis under which data is exchanged rather than ‘consent’, with the innovation being that the contracts are written from the individual perspective.
- The W3C Community Group backed Data Privacy Vocabulary as the host for key words, definitions and machine-readable components.
The diagram below visualises the approach. The key aspects of it are:
- Both first and second parties have software agents acting on their behalf
- There is a standard roster of contracts to chose from
- Both parties sign the contract, via their agents
- Both parties retain their own copy of the signed agreement
We are working on thirteen Draft Agreements that will conform to the standard at Customer Commons). Three of those are based around personal data contributions that are ‘one-off’ scenarios. Ten are ‘relationship-based’.
The one-off scenarios being worked on at present are as below, where PDC = Personal Data Contribution:
- PDC-INTENT (to enable buying intentions to be shared without those being then re-shared/ re-used for other purposes such as building profiles)
- PDC-GOOD (to enable people to donate data for public benefit causes with the data share being constrained to that specific purpose)
- PDC-AI (to enable people to contribute their data to AI training and operations with a higher degree of transparency and control than the current norm)
The relationship-based scenarios begin with SD-BY and SD-BY-DP and evolve from there to include additional data processing purposes as being in scope.
SD-BY will likely be the most common deployment in that it mirrors the data minimisation scenario pointed to as the regulatory requirement in GDPR and other privacy regulations. That is to say, if I am buying or receiving a product/ service from an organisation then I provide the data required for that product/ service delivery – but no more. And the purposes that data can be used for are constrained to delivering that product/ service. This is clearly our attempt to mitigate the current approach in which privacy policies are rarely as easy to understand as they should be, and in being so often mask data gathering and uses over and above that required to deliver the base product/ service.
SD-BY-DP introduces the concept of automated data portability, i.e. the individual gets a copy of the contracted data automatically made available to their agent.
It is a reasonable to assume that the parties can evolve from one off scenarios into relationship-based ones.
None of the agreements permit third party tracking, i.e. the practices through which cookies and similar technologies allow personal data to be shared to parties other than the provider of the site/ app being accessed.
A view of our draft PDC-INTENT human-readable agreement is shown below. It will evolve and be tested with the relevant stakeholders in advance of deployment.
📄 PDC-INTENT – Use of Personal Data under MyTerms
Purpose: Term that indicates access to data is being provided for the purposes of Intentcasting
🔍 Human-Readable Summary (Plain English)
This contract puts you, the individual, in control of how your personal data is used. You’re offering your data with clear terms — and an organization must agree to those terms if they want to use it.
✅ What You’re Offering
- To provide buying intention data to an organisation in order that they can respond with information and offers in relation to what you are in the market for
- Your buying intention data can be processed, but only for this purpose — no extra uses are permitted.
- Your buying intention data will be deleted on completion of the Intentcast process, or transitioned into
🚫 What The Organisation Receiving Your Data is Not Allowed To Do
- The organisation cannot use your data for analytics.
- No one — not the organisation, not third parties — can process your data for analytical purposes.
- The organisation cannot track you to build/ augment a profile they have for you.
- Tracking of any kind is prohibited.
- The organisation cannot profile you using your data.
- No profiling is allowed by the organisation or anyone else.
- The organisation cannot share your personal data with third parties.
- Your information stays between you and the organisation.
The visualisation below is an illustration of one way, of many, in which MyTerms might surface in practice. We have the added advantage in that the concept of agents acting on behalf of individuals is now very much mainstream.
We’ll have lot’s more to say on the standard itself and the agreements we will make available over the next few months.
