News Feed
Forgot your password?
New user?
WP6 Legal, Privacy and Ethics
TAS3_D06p1 Privacy Requirements v2p0.pdf
TAS3 D6.1 Accepted by European Commission in March 2010. Executive Summary: TAS3 is designed to provide a secure and trusted architecture that is compliant with applicable privacy requirements. TAS3 goes beyond traditional privacy by design to include design of privacy in not only in the technical design, but also in business processes, organizational policies and in a privacy enabling contractual framework from the outset. The TAS3 architecture thus combines the four elements of technology, business, policy and legal requirements to provide a privacy-enabled ecosystem. The focus of this deliverable is to identify the privacy requirements that are set forth in the European Directive and national implementations that support the fundamental right of privacy. TAS3 D6.2, which sets forth the Contractual and Policy Frameworks, will incorporate and build on these requirements. . As part of this design approach we also review the “7 laws of embedded identity”, as developed by Information and Privacy Commissioner Ann Cavoukian in furtherance of Kim Cameron’s first published seven Laws of Identity. The purpose of this deliverable is to translate the broad legal requirements related to privacy and governance into concepts that can provide technical and organizational guidance. Annex 1 provides a comparative review of the major instruments on which EU privacy law is founded as well as the laws of countries in which TAS3 may take place. From those documents common principles are distilled. The deliverable then maps the application of those principles and related terms of art to new technologies to illustrate the challenges that are emerging. Then, before concentrating on the specific requirements of the Directive, we review emerging global and EU trends in accountability and accountable systems. More detailed legal requirements are then identified and cross-referenced to TAS3 functions and practices (Summarized in Annex 3). Finally an overview of requirements and their operational relevance is given. In order to maintain the currency of the document, periodic annexes will be included to provide updates on trends and emerging concepts related to privacy requirements. The provision of annexes also helps readers focus on developing trends that may impact the requirements. As these developments become more established, or codified, the will be integrated into the paper. This document represents the beginning of an iterative process, which will continue throughout the TAS3 project by way of refinement and supplement. Apart from tracking changes in actual law and the application of existing law, more detailed research will be performed related to relevant sectoral laws, which may also impact privacy requirements (e.g. employee privacy rights; regulations impacting electronic health records).
TAS3_D6p1_v1p0.pdf (deprecated)
TAS3 Requirements: Privacy, Governance and Contractual Options Accepted by European Commission in June 2009. Executive Summary: TAS3 is designed to provide a secure and trusted architecture that is compliant with applicable privacy requirements. TAS3 goes beyond traditional privacy by design to include design of privacy in not only in the technical design, but also in business processes, organizational policies and in a privacy enabling contractual framework from the outset. The TAS3 architecture thus combines the four elements of technology, business, policy and legal requirements to provide a privacy-enabled ecosystem. The focus of this deliverable is to identify the privacy requirements that are set forth in the European Directive and national implementations that support the fundamental right of privacy. TAS3 D6.2, which sets forth the Contractual and Policy Frameworks, will incorporate and build on these requirements. . As part of this design approach we also review the “7 laws of embedded identity”, as developed by Information and Privacy Commissioner Ann Cavoukian in furtherance of Kim Cameron’s first published seven Laws of Identity. The purpose of this deliverable is to translate the broad legal requirements related to privacy and governance into concepts that can provide technical and organizational guidance. Annex 1 provides a comparative review of the major instruments on which EU privacy law is founded as well as the laws of countries in which TAS3 may take place. From those documents common principles are distilled. The deliverable then maps the application of those principles and related terms of art to new technologies to illustrate the challenges that are emerging. Then, before concentrating on the specific requirements of the Directive, we review emerging global and EU trends in accountability and accountable systems. More detailed legal requirements are then identified and cross-referenced to TAS3 functions and practices (Summarized in Annex 3). Finally an overview of requirements and their operational relevance is given.. This document represents the beginning of an iterative process, which will continue throughout the TAS3 project by way of refinement and supplement. Apart from tracking changes in actual law and the application of existing law, more detailed research will be performed related to relevant sectoral laws, which may also impact privacy requirements (e.g. employee privacy rights; regulations impacting electronic health records).
TAS3_D06p2 Contractual Framework V3p0.pdf
TAS3 D6.2 Accepted by European Commission in March 2010. Executive Summary: The objective of TAS³ is to develop a secure, yet adaptable technical infrastructure that enables the creation, maintenance and exchange of personal information between multiple service providers in a user-centric fashion. TAS³ relies on the concept of a Trust Network that is governed by business requirements, technical requirements, policy requirements and legal requirements. This deliverable focuses on the development of a flexible and adaptable contractual framework for all TAS³ participants and general policy requirements that shall support the Trust Network by defining and enforcing enterprise policies at the level of individual service providers. Changes in jobs, residences, and professional and social relationships are more frequent occurrences than ever before. Information must be portable and accessible to meet the needs of organizations, individuals and society as a whole. Providing this portability and flexibility is also key to remaining competitive and enabling growth in the information society and digital economy. TAS3 enables an infrastructure of trust, security and privacy to meet the needs of today’s more global and mobile society. TAS3’s development is geared to compliance with privacy laws and provides for both user control and organizational functionality of records. TAS3 thus combines security and privacy with technology, policy and law to create a trust infrastructure predicated on verifiable information governance. TAS³’s approach which co-ordinates the development of contract, policy, technology and business requirements at the inception of the project improves on existing models of privacy by design (often limited to embedding privacy technology at the design stage). This broader and earlier collaboration across the 4 elements mentioned above creates a more seamless support of privacy, which in turn enables and enhances trust for data subjects. In many design and development situations the interdependent nature of the 4 elements is insufficiently optimized. In TAS³, interactions across entities are designed to enhance system optimization. Information collection, access and transfer proceed in accordance with data minimization; legal and compliance obligations are supported in audit protocols, and required enterprise policies supplement security, use limitation, and other data protection requirements. This optimization also occurs at the ecosystem rather than just enterprise/organization level, thereby providing more seamless and end-to-end integration of requirements across the 4 elements of the Trust Network. Obviously recourse to national data protection authorities and courts always remains possible in case of non-compliance. TAS³ however also seeks to provide the data subject with more simple paths to compliance enforcement that can be accomplished entirely from within the TAS³ Network. The TAS³ contractual framework exists and operates at three levels: Ecosystem, Transaction and Technical. The Ecosystem level provides the general binding of rights and obligations across all parties, including general terms and conditions, required technical implementations and requirements for policies at the level of individual organizations. The Ecosystem contract is drafted in counterpart forms adapted to the role of the individual user/entity, but with large commonalities for the core aspects of the TAS³ Ecosystem. Transaction level contracts provide an opportunity to supplement or enhance controls and instructions related to a specific role in a transaction. Because these contracts need to be tailored to the specific context of the transaction, we are exploring how to develop standard contracts for different types of transactions with attached schedules to provide the customization as well as dynamically generated contracts at the time of the transaction. This modular drafting will lessen the need to involve legal counsel at every transaction and thus increase speed and reducing cost. Obligations are put in place at the technical level through sticky policies and other privacy management and negotiation elements of the architecture. As these obligations are expressed through technical means that may never be explicated in writing, they are explicitly supported and accepted by the parties as binding through agreement to the Ecosystem contract. Since the contractual framework binds all parties, it is horizontal in its very nature and is relevant to all TAS³ work packages. The contract and policy frameworks, which will be described in this document, are mostly dependent upon both the Legal Requirements previously defined in TAS³ D6.1 as well as the Architecture requirements developed in TAS³ D2.1. The requirements that were identified in WP 1 (TAS³ D1.2, D1.4 as well as the consideration of the current state of the art in TAS³ D1.1) serve as inputs to this document. Conversely, WP6 has in turn identified its own requirements and provided input to both D1.2 and D1.4 (annex 4). The Demonstrator projects set forth in TAS³ D9.1 serve both as inputs to the contractual framework and will serve in continued iterations as proving grounds for testing actual contract terms. The TAS³ Network is an example of Privacy-by-design and enables organizations to be more transparent as to their obligations and accountable for their proper exercise. These concepts of Privacy by Design and accountability are important developing trends in privacy in the EU as set forth in the 2009 Privacy Update Annex V to TAS3 D6.1. The collaborative design of TAS3 resulting in mutual support across disciplines (law, policy technology) is an end goal of Privacy by Design and yields greater levels of accountability.
TAS3_D6p2_v2p0.pdf (deprecated)
TAS3 Contractual Framework Accepted by European Commission in June 2009. Executive Summary: The objective of TAS³ is to develop a secure, yet adaptable technical infrastructure that enables the creation, maintenance and exchange of personal information between multiple service providers in a user-centric fashion. TAS³ relies on the concept of a Trust Network that is governed by business requirements, technical requirements, policy requirements and legal requirements. This deliverable focuses on the development of a flexible and adaptable contractual framework for all TAS³ participants and general policy requirements that shall support the Trust Network by defining and enforcing enterprise policies at the level of individual service providers. Changes in jobs, residences, and professional and social relationships are more frequent occurrences than ever before. Information must be portable and accessible to meet the needs of organizations, individuals and society as a whole. Providing this portability and flexibility is also key to remaining competitive and enabling growth in the information society and digital economy. TAS3 enables an infrastructure of trust, security and privacy to meet the needs of today’s more global and mobile society. TAS3’s development is geared to compliance with privacy laws and provides for both user control and organizational functionality of records. TAS3 thus combines security and privacy with technology, policy and law to create a trust infrastructure predicated on verifiable information governance. TAS³’s approach which co-ordinates the development of contract, policy, technology and business requirements at the inception of the project improves on existing models of privacy by design (often limited to embedding privacy technology at the design stage). This broader and earlier collaboration across the 4 elements mentioned above creates a more seamless support of privacy, which in turn enables and enhances trust for data subjects. In many design and development situations the interdependent nature of the 4 elements is insufficiently optimized. In TAS³, interactions across entities are designed to enhance system optimization. Information collection, access and transfer proceed in accordance with data minimization; legal and compliance obligations are supported in audit protocols, and required enterprise policies supplement security, use limitation, and other data protection requirements. This optimization also occurs at the ecosystem rather than just enterprise/organization level, thereby providing more seamless and end-to-end integration of requirements across the 4 elements of the Trust Network. Obviously recourse to national data protection authorities and courts always remains possible in case of non-compliance. TAS³ however also seeks to provide the data subject with more simple paths to compliance enforcement that can be accomplished entirely from within the TAS³ network. The TAS³ contractual framework exists and operates at three levels: Ecosystem, Transaction and Technical. The Ecosystem level provides the general binding of rights and obligations across all parties, including general terms and conditions, required technical implementations and requirements for policies at the level of individual organizations. The Ecosystem contract is drafted in counterpart forms adapted to the role of the individual user/entity, but with large commonalities for the core aspects of the TAS³ Ecosystem. Transaction level contracts provide an opportunity to supplement or enhance controls and instructions related to a specific transaction. Because these contracts need to be tailored to the specific context of the transaction, we are exploring how to develop standard contracts for different types of transactions with attached schedules to provide the customization. This modular drafting will lessen the need to involve legal counsel at every transaction and thus increase speed and reducing cost. Obligations are put in place at the technical level through sticky policies and other privacy management and negotiation elements of the architecture. As these obligations are expressed through technical means that may never be explicated in writing, they are explicitly supported and accepted by the parties as binding through agreement to the Ecosystem contract. Since the contractual framework binds all parties, it is horizontal in its very nature and is relevant to all TAS³ work packages. The contract and policy frameworks, which will be described in this document, are mostly dependent upon both the Legal Requirements previously defined in TAS³ D6.1 as well as the Architecture requirements developed in TAS³ D2.1. The requirements that were identified in WP 1 (TAS³ D1.2, D1.4 as well as the consideration of the current state of the art in TAS³ D1.1) serve as inputs to this document. Conversely, WP6 has in turn identified its own requirements and provided input to both D1.2 and D1.4 (annex 4). The Demonstrator projects set forth in TAS³ D9.1 serve both as inputs to the contractual framework and will serve in continued iterations as proving grounds for testing actual contract terms.
