PS-SDA: Provenance services with Smart Data Agreements

ABOUT THE PROJECT

PS-SDA: Provenance services with Smart Data Agreement 

iGrant.io is a MyData Operator platform for human-centric personal data management, enabling a transparent and regulatory compliant data exchange. Every data exchange has an associated auditable and verifiable Data Agreement (DA) that records conditions for an organization to process personal data in accordance with GDPR {{1, 2}}. The DA is mutually signed by the organisation and the individual and is based on open specification published via the W3C (e.g. DID:mydata).

In this proposal, the DA specification is extended with data provenance metadata and is stored in a chain and can be resolved independently. Data exchange between two organisations is facilitated by a smart contract that guarantees creation of DAs, enforcing GDPR compliance. When the data moves from a Data Source to any Data Using Service, individual sign off is ensured and the DA is updated with provenance data, adding to the history of data usage from its inception and beyond.

This proposal addresses one of the key issues of data governance by enabling data provenance and enforcing GDPR requirements via a smart contract. This allows organisations to audit and resolve DAs to attain legitimacy in processing personal data and to be transparent in their use of personal data. The key activities include:

1. Specify and extend the existing DA protocol suite to enable data provenance to trace and record the origins of data and its movement between data processing organisations.
2. Develop associated APIs and SDKs to perform DA CRUD operations to enable data exchange between organisations, guaranteed through a smart contract.
3. Propagate data updates across the chain including revoking the DAs across all intermediaries in the chain.
4. Contribute to ISO standardisation (for consents) with provenance requirements.

References:

{{1}} Automated Data Agreement Project Page

{{2}} Data Agreement Specification: Linquist, J., Lundin, L and Chandran, L

PROJECT OUTCOMES

The PS-SDA project brings forth the Data Exchange Agreement (DEXA) protocol suite that is a key component for developing and deploying trustworthy decentralised data applications across domains. 

The DEXA protocol suite helps organisations exchange personal data (both Data Sources (DS) and Data Using Services (DUS)) to ensure that all data transactions are lawful, scalable and verifiable. It brings in the requisite trust and governance to establish a ubiquitous data exchange marketplace. All organisations need to ensure that they are on the right side of the law (e.g. the GDPR) when consuming personal data (risk management) and to establish the digital trust needed for individuals to say yes to sharing their data.

The key values provided by the DEXA components include

• tamper-proof mechanisms to prove a data exchange transaction, provenance trail of a B2B data exchange agreements and transactions

• compliance enforcement to data regulations for any DUS

• highly scalable, lawful mechanisms for entering into data sharing agreements in an automated manner.

The agreements record the conditions for an organisation to process personal data following privacy regulations captured in a signed receipt given to the individual. By automating the agreement handling process and ensuring immutability through the use of DLT, the scalability of the data exchange and the auditability of the same are ensured.

Repositories:

data-exchange-agreements: http://data-exchange-agreements

dexa-protocol (DEXA ACA-Py Plugin): https://github.com/decentralised-dataexchange/dexa-protocol

dexa-sdk: https://github.com/decentralised-dataexchange/dexa-sdk

dexa-smart-contract: https://github.com/decentralised-dataexchange/dexa-smartcontracts

aries-playground: https://github.com/decentralised-dataexchange/aries-playground

Documentation:

Data Exchange Agreement Specifications: https://github.com/decentralised-dataexchange/data-exchange-agreements

iGrant.io data exchange docs: https://docs.igrant.io/docs/

APIs are hosted at: https://ds-agent.igrant.io/api/doc 

TEAM

ENTITIES