Address legal compliance, security, and privacy through Specifications

Inizia leggendo l’articolo collegato nell’issue, in particolare la Sezione 8, e confronta le sue preoccupazioni con quelle delle issue collegate relative a vocabulary, data-interoperability e authorization-panel. Per considerare il lavoro completato, sarebbe necessaria una decisione della community sull’ambito, seguita dai corrispondenti output di specifica o documentazione; non viene indicato alcun file o test specifico.

Hi. An adopter or user of Solid faces the following three questions:

1. How to describe what their implementation and use-case is regarding use of 'Solid' ?
2. How does Solid relate to relevant laws (in my case, GDPR)?
3. What issues or problems are applicable to Solid?

I have answered this through an article titled "Making Sense of Solid for Data Governance and GDPR" https://osf.io/m29hn/ that considers use of Solid as cloud technology which gives different possible governance models (e.g. self-hosted, pod from providers), which enables specific analysis of how Solid specifications in their current state relate to GDPR (because I focus on EU, but the issues are also broadly applicable). I found that there are important gaps and incompatibilities that result in problems and uncertainties for an adopter. These arise from specifications not containing information, processes, diverging in terminologies, etc. I also discuss how Solid is vulnerable to existing problematic practices in centralised models (e.g. see https://github.com/solid/authorization-panel/issues/46#issuecomment-1285486479 and article Section.7).

While is it possible that an adopter or end-user is also aware of the above problems, and implements solutions to fix them, IMHO this will eventually create divergence in Solid implementations, and thus challenges for portability and interoperability of data, pods, and apps. If there will be different incompatible approaches to solve common problems, we may end up with new centralised or walled models that use Solid - which would be self-defeating for Solid's goals.

Instead, IMO, Solid specifications should provide a solid (pun intended) framework that assists if not solves these issues related to legal compliance, security, privacy, and data protection, and through this provides a minimum level of trust and commonality in the use of Solid across implementations and use-cases. The article provides some ideas for this (Section.8), and there are other issues that relate to this - https://github.com/solid/vocab/issues/83 (vocab for actors), solid/data-interoperability-panel/issues/282 (separation of Agents), and solid/authorization-panel/issues/46 (trusting an app).

I'm not the first to consider the legal or privacy perspectives of Solid (the article has some good references), and I won't be the last - for example the EU's authorities are looking into Solid as part of the next potential innovative disruption (ref:EDPS). I'm also aware that there have been several discussions within Solid community (e.g. consent, use of policies) - but as there are no visible outputs and Solid is being considered for a W3C WG track, I'm requesting this be considered an important topic and the Solid community should either (1) agree that the above is an issue that needs attention; or (2) make it explicit in the specs or docs that the above is not in scope - and therefore clarify that either implementers should develop their own solutions or the community can do so as an extension or additional specification.