STEPPING UP TO NEWDATA PROTECTION CHALLENGES
USER-MANAGED ACCESS FOR GENUINE CONSENT
Eve Maler (@xmlgrrl)
Hard truths about the business of data privacy
Copyright © Identity Summit 2015, all rights reserved.
From the webto the IoT,
the “fear/greed” tension around data sharing is only going to
grow
Copyright © Identity Summit 2015, all rights reserved.
“In order to ensure free consent, it should be clarified that consent does
not provide a valid legal ground where the individual has no genuine and free choice and is subsequently
not able to refuse to withdraw consent without detriment. …. The data subject shall have the right to withdraw his or her consent at any
time.”
The Chief Privacy Officer and Chief Digital Officer need to meet in the middle
Copyright © Identity Summit 2015, all rights reserved.
1. We value personal data as an asset2. We value our customers’ wishes3. Our customers have their own
reasons to share, not share, and mash up data
4. Privacy can never simply be secrecy5. Privacy is, fundamentally:
a. Contextb. Controlc. Choiced. Respect
Digital consent tools through time
Copyright © Identity Summit 2015, all rights reserved.
Web
API economy
IoT economy
• Browse-wrap• Click-notice• Opt-in• Opt-out• Cookies• “Share”
• API-wrap• Mobile app store
download opt-in• OAuth
• Consent receipts• UMA• …
The two most familiar “emerging” consent tools only take us so far
Standard, constrainable consent for app access…but run-time and point-to-point
Constrainable “consented delegation” to other parties…but proprietary and limited
Copyright © Identity Summit 2015, all rights reserved.
“Share” OAuth
The new Venn of access
control and consent
Copyright © Identity Summit 2015, all rights reserved.
The mechanism:
federated authorization
on top of OAuth
Loosely coupled to enablecentralized authorization-as-a-service and a central sharing management hub
Enables party-to-party sharing – without credential sharing – driven by fine-grained policy rather than run-time opt-in consent
The requesting party is tested for authorization suitability through trust elevation, e.g. step-up authentication or “claims-based access control”
Copyright © Identity Summit 2015, all rights reserved.
Why is it valuable to use a standard fornext-generation digital consent?
Copyright © Identity Summit 2015, all rights reserved.
This isn’t just slideware – see our live demo in the CTO Technology
Preview!
Copyright © Identity Summit 2015, all rights reserved.
ForgeRock is delivering two key UMA components not long from now
(client)
OpenAM 13-basedUMA Provider
OpenIG 4-basedUMA Protector
Copyright © Identity Summit 2015, all rights reserved.
resource server authorization server
ForgeRock helps you deliver customer consent and delegation
capabilities for successfuldigital transformation in aprivacy-sensitive world
Copyright © Identity Summit 2015, all rights reserved.
THANKS!
Eve Maler (@xmlgrrl)