Difference between revisions of "CEN-CENELEC-ETSI Activities"

From IPEN Wiki
Jump to navigation Jump to search
m
m
Line 1: Line 1:
<p>This page focuses on activities related to privacy carried out in the European Standardisation Organisations (ESOs)
This page focuses on activities related to privacy carried out in the European Standardisation Organisations (ESOs)
</p><p><img src="/images/ipen/c/c0/CEN_CENELEC.jpg" _fck_mw_filename="CEN CENELEC.jpg" alt="" /><img src="/images/ipen/b/b3/ETSI.jpg" _fck_mw_filename="ETSI.jpg" alt="" />
</p>
<h2> <span style="font-size: larger; line-height: 1.2">CEN-CENELEC JWG8 on Privacy Management of Security Products and Related Services</span> </h2>
<table style="width: 900px" border="1" cellpadding="1" cellspacing="1">


<tr>
&lt;img src="/images/ipen/c/c0/CEN_CENELEC.jpg" _fck_mw_filename="CEN CENELEC.jpg" alt="" /&gt;&lt;img src="/images/ipen/b/b3/ETSI.jpg" _fck_mw_filename="ETSI.jpg" alt="" /&gt;
<td> Context<br />
 
</td>
== <span style="font-size: larger;  line-height: 1.2">CEN-CENELEC JWG8 on Privacy Management of Security Products and Related Services</span> ==
<td>
 
<p>The European commission has issued in early 2015 a mandate to European Standardisation Organisations (or ESOs), CEN, CENELEC, ETSI) to work on a roadmap of standards covering the privacy management of security products and related services
{| style="width: 900px" border="1" cellpadding="1" cellspacing="1"
</p><p><span style="line-height: 1.6">Consequently, CEN/CENELEC has decided to launch a joint working group JWG8, the secretariat of which will be managed by AFNOR (France).</span>
|-
</p><p>The objective if to define a roadmap and work plan for October 2015
| Context<br/>
</p>
|
</td></tr>
The European commission has issued in early 2015 a mandate to European Standardisation Organisations (or ESOs), CEN, CENELEC, ETSI) to work on a roadmap of standards covering the privacy management of security products and related services
<tr>
 
<td> URL
<span style="line-height: 1.6">Consequently, CEN/CENELEC has decided to launch a joint working group JWG8, the secretariat of which will be managed by AFNOR (France).</span>
</td>
 
<td>
The objective if to define a roadmap and work plan for October 2015
<p>Mandate page:&#160;<a href="http://ec.europa.eu/growth/tools-databases/mandates/index.cfm?fuseaction=search.detail&amp;id=548">http://ec.europa.eu/growth/tools-databases/mandates/index.cfm?fuseaction=search.detail&amp;id=548</a>
 
</p><p>JWG8 page:&#160;<a href="http://www.cencenelec.eu/standards/Sectors/DefenceSecurityPrivacy/Privacy/Pages/default.aspx">http://www.cencenelec.eu/standards/Sectors/DefenceSecurityPrivacy/Privacy/Pages/default.aspx</a>
|-
</p>
| URL
</td></tr>
|
<tr>
Mandate page:&nbsp;<a href="[http://ec.europa.eu/growth/tools-databases/mandates/index.cfm?fuseaction=search.detail&id=548 http://ec.europa.eu/growth/tools-databases/mandates/index.cfm?fuseaction=search.detail&amp;id=548]">[http://ec.europa.eu/growth/tools-databases/mandates/index.cfm?fuseaction=search.detail&id=548 http://ec.europa.eu/growth/tools-databases/mandates/index.cfm?fuseaction=search.detail&amp;id=548]&lt;/a&gt;
<td> Members of JWG8
 
</td>
JWG8 page:&nbsp;<a href="[http://www.cencenelec.eu/standards/Sectors/DefenceSecurityPrivacy/Privacy/Pages/default.aspx http://www.cencenelec.eu/standards/Sectors/DefenceSecurityPrivacy/Privacy/Pages/default.aspx]">[http://www.cencenelec.eu/standards/Sectors/DefenceSecurityPrivacy/Privacy/Pages/default.aspx http://www.cencenelec.eu/standards/Sectors/DefenceSecurityPrivacy/Privacy/Pages/default.aspx]&lt;/a&gt;
<td>
 
<p>Working group structure
|-
</p>
| Members of JWG8
|
Working group structure
<ul style="line-height: 18.9090900421143px;">
<ul style="line-height: 18.9090900421143px;">
<li>Chair: Claire Waast-Richards (EDF)</li>
<li>Chair: Claire Waast-Richards (EDF)</li>
</ul>
</ul>
<p>Editing team
 
</p>
Editing team
<ul style="line-height: 18.9090900421143px;">
<ul style="line-height: 18.9090900421143px;">
<li>French delegation: Antonio Kung, Mourad Faher, Denis Pinkas</li>
<li>French delegation: Antonio Kung, Mourad Faher, Denis Pinkas</li>
Line 40: Line 38:
<li>CEN-CENELEC: Alina Iatan</li>
<li>CEN-CENELEC: Alina Iatan</li>
</ul>
</ul>
</td></tr>
<tr>
<td> Comments
</td>
<td>
<p>[Antonio Kung]
</p>
<ul>
<li>During the IPEN workshop it was made clear that the concept of security products should be more clearly defined (in particular on the contradiction between surveillance and privacy)
</li>
</ul>
</td></tr></table>
<p><br />
</p>
<h2> <span style="font-size: larger; line-height: 1.2">CEN/TC225 - AIDC technologies</span> </h2>
<p><span style="line-height: 1.6">As stated in Wikipedia&#160;: <i>Automatic identification and data capture (AIDC) refers to the methods of automatically identifying objects, collecting data about them, and entering that data directly into computer systems (i.e. without human involvement). Technologies typically considered as part of AIDC include bar codes, Radio Frequency Identification (RFID), biometrics, magnetic stripes, Optical Character Recognition (OCR), smart cards, and voice recognition. AIDC is also commonly referred to as “Automatic Identification,” “Auto-ID,” and "Automatic Data Capture."</i></span>
</p>
<h3> <span style="font-size: 18.2520008087158px; line-height: 29.2032012939453px">Data Protection, Privacy and Information Aspects of RFID</span> </h3>
<table style="line-height: 20.7999992370605px; width: 900px" border="1" cellpadding="1" cellspacing="1">


<tr>
|-
<td> Context
| Comments
</td>
|
<td>
[Antonio Kung]
<p>In December 2008, the European Commission addressed the Mandate M/436 to CEN, CENELEC and ETSI in the field of ICT as applied to RFID systems.&#160;The Mandate M/436 was accepted by the ESOs in the first months of 2009. The Mandate addresses the data protection, privacy and information aspects of RFID, and is being executed in two phases.
 
</p><p>Phase 1, completed in May 2011, identified the work needed to produce a complete framework of future RFID standards. The Phase 1 results are contained in the ETSI Technical Report&#160;<a href="http://www.etsi.org/deliver/etsi_tr/187000_187099/187020/01.01.01_60/tr_187020v010101p.pdf">TR 187 020</a>, which was published in May 2011.
*During the IPEN workshop it was made clear that the concept of security products should be more clearly defined (in particular on the contradiction between surveillance and privacy)
</p><p>Phase 2 is concerned with the execution of the standardisation work programme identified in the first phase. This second phase ended in July 2014 with the publication of different technical reports and the publication of two European standards:
 
</p><p><font color="#333333"><a href="http://standards.cen.eu/dyn/www/f?p=204:110:0::::FSP_PROJECT:38577&amp;cs=1201C63DE7F80DEAB30AE7D3BD4035F0A">EN 16571</a>: «&#160;Information technology - RFID privacy impact assessment process» and</font>
|}
</p><p><font color="#333333"><a href="http://standards.cen.eu/dyn/www/f?p=204:110:0::::FSP_PROJECT:38350&amp;cs=117C4B4C6C024833E3B87802F882742D0">EN 16570</a>: «&#160;Information technology - Notification of RFID - The information sign and additional information to be provided by operators of RFID application systems».</font>
 
</p><p>Here is a powerpoint presentation of TC225&#160;:&#160;<a href="http://docbox.etsi.org/Workshop/2013/201301_SECURITYWORKSHOP/03_CENCENELEC_Standardization/CEN_TC225_M436_DESSENNE.pdf">http://docbox.etsi.org/Workshop/2013/201301_SECURITYWORKSHOP/03_CENCENELEC_Standardization/CEN_TC225_M436_DESSENNE.pdf</a>
 
</p>
 
</td></tr>
== <span style="font-size: larger;  line-height: 1.2">CEN/TC225 - AIDC technologies</span> ==
<tr>
 
<td> URL
<span style="line-height: 1.6">As stated in Wikipedia&nbsp;: ''Automatic identification and data capture (AIDC) refers to the methods of automatically identifying objects, collecting data about them, and entering that data directly into computer systems (i.e. without human involvement). Technologies typically considered as part of AIDC include bar codes, Radio Frequency Identification (RFID), biometrics, magnetic stripes, Optical Character Recognition (OCR), smart cards, and voice recognition. AIDC is also commonly referred to as “Automatic Identification,” “Auto-ID,” and "Automatic Data Capture."''</span>
</td>
 
<td>
=== <span style="font-size: 18.2520008087158px;  line-height: 29.2032012939453px">Data Protection, Privacy and Information Aspects of RFID</span> ===
<p>Mandate page:&#160;<a href="http://ec.europa.eu/growth/tools-databases/mandates/index.cfm?fuseaction=search.detail&amp;id=415">M/436</a>
 
</p><p>CEN/TC225 page:&#160;<a href="http://standards.cen.eu/dyn/www/f?p=204:7:0::::FSP_LANG_ID,FSP_ORG_ID:25,6206&amp;cs=1655B872A8BB9229C9ABA80AB8819C24A#1">CEN/TC225</a>
{| style="line-height: 20.7999992370605px;  width: 900px" border="1" cellpadding="1" cellspacing="1"
</p>
|-
</td></tr>
| Context
<tr>
|
<td> Members of CEN/TC225
In December 2008, the European Commission addressed the Mandate M/436 to CEN, CENELEC and ETSI in the field of ICT as applied to RFID systems.&nbsp;The Mandate M/436 was accepted by the ESOs in the first months of 2009. The Mandate addresses the data protection, privacy and information aspects of RFID, and is being executed in two phases.
</td>
 
<td>
Phase 1, completed in May 2011, identified the work needed to produce a complete framework of future RFID standards. The Phase 1 results are contained in the ETSI Technical Report&nbsp;<a href="[http://www.etsi.org/deliver/etsi_tr/187000_187099/187020/01.01.01_60/tr_187020v010101p.pdf http://www.etsi.org/deliver/etsi_tr/187000_187099/187020/01.01.01_60/tr_187020v010101p.pdf]">TR 187 020&lt;/a&gt;, which was published in May 2011.
<p>A dedicated Project Team has been appointed to draft the EN 16571 on PIA for RFID applications
 
</p>
Phase 2 is concerned with the execution of the standardisation work programme identified in the first phase. This second phase ended in July 2014 with the publication of different technical reports and the publication of two European standards:
 
<font color="#333333"><a href="[http://standards.cen.eu/dyn/www/f?p=204:110:0::::FSP_PROJECT:38577&cs=1201C63DE7F80DEAB30AE7D3BD4035F0A http://standards.cen.eu/dyn/www/f?p=204:110:0::::FSP_PROJECT:38577&amp;cs=1201C63DE7F80DEAB30AE7D3BD4035F0A]">EN 16571&lt;/a&gt;: «&nbsp;Information technology - RFID privacy impact assessment process» and</font>
 
<font color="#333333"><a href="[http://standards.cen.eu/dyn/www/f?p=204:110:0::::FSP_PROJECT:38350&cs=117C4B4C6C024833E3B87802F882742D0 http://standards.cen.eu/dyn/www/f?p=204:110:0::::FSP_PROJECT:38350&amp;cs=117C4B4C6C024833E3B87802F882742D0]">EN 16570&lt;/a&gt;: «&nbsp;Information technology - Notification of RFID - The information sign and additional information to be provided by operators of RFID application systems».</font>
 
Here is a powerpoint presentation of TC225&nbsp;:&nbsp;<a href="[http://docbox.etsi.org/Workshop/2013/201301_SECURITYWORKSHOP/03_CENCENELEC_Standardization/CEN_TC225_M436_DESSENNE.pdf http://docbox.etsi.org/Workshop/2013/201301_SECURITYWORKSHOP/03_CENCENELEC_Standardization/CEN_TC225_M436_DESSENNE.pdf]">[http://docbox.etsi.org/Workshop/2013/201301_SECURITYWORKSHOP/03_CENCENELEC_Standardization/CEN_TC225_M436_DESSENNE.pdf http://docbox.etsi.org/Workshop/2013/201301_SECURITYWORKSHOP/03_CENCENELEC_Standardization/CEN_TC225_M436_DESSENNE.pdf]&lt;/a&gt;
 
|-
| URL
|
Mandate page:&nbsp;<a href="[http://ec.europa.eu/growth/tools-databases/mandates/index.cfm?fuseaction=search.detail&id=415 http://ec.europa.eu/growth/tools-databases/mandates/index.cfm?fuseaction=search.detail&amp;id=415]">M/436&lt;/a&gt;
 
CEN/TC225 page:&nbsp;<a href="[http://standards.cen.eu/dyn/www/f?p=204:7:0::::FSP_LANG_ID,FSP_ORG_ID:25,6206&cs=1655B872A8BB9229C9ABA80AB8819C24A#1 http://standards.cen.eu/dyn/www/f?p=204:7:0::::FSP_LANG_ID,FSP_ORG_ID:25,6206&amp;cs=1655B872A8BB9229C9ABA80AB8819C24A#1]">CEN/TC225&lt;/a&gt;
 
|-
| Members of CEN/TC225
|
A dedicated Project Team has been appointed to draft the EN 16571 on PIA for RFID applications
<ul style="line-height: 18.9090900421143px;">
<ul style="line-height: 18.9090900421143px;">
<li><span style="line-height: 20.7999992370605px">Project Leader: Claude Tételin (<a href="http://www.centrenational-rfid.com/index_gb.cfm">French RFID National Centre</a>)</span></li>
<li><span style="line-height: 20.7999992370605px">Project Leader: Claude Tételin (<a href="[http://www.centrenational-rfid.com/index_gb.cfm http://www.centrenational-rfid.com/index_gb.cfm]">French RFID National Centre&lt;/a&gt;)</span></li>
</ul>
</ul>
<p>Editing team
 
</p>
Editing team
<ul style="line-height: 18.9090900421143px;">
<ul style="line-height: 18.9090900421143px;">
<li><span style="line-height: 20.7999992370605px">Paul Chartier (<a href="https://www.convergent-software.co.uk/">Convergent Software Limited</a>, UK), editor</span></li>
<li><span style="line-height: 20.7999992370605px">Paul Chartier (<a href="[https://www.convergent-software.co.uk/ https://www.convergent-software.co.uk/]">Convergent Software Limited&lt;/a&gt;, UK), editor</span></li>
<li>Sandra Hohenecker&#160;(<a href="https://www.gs1-germany.de/">GS1 Germany</a>)</li>
<li>Sandra Hohenecker&nbsp;(<a href="[https://www.gs1-germany.de/ https://www.gs1-germany.de/]">GS1 Germany&lt;/a&gt;)</li>
<li>John Borking (<a href="https://www.european-privacy-seal.eu/EPS-en/Home">EuroPriSe</a>)</li>
<li>John Borking (<a href="[https://www.european-privacy-seal.eu/EPS-en/Home https://www.european-privacy-seal.eu/EPS-en/Home]">EuroPriSe&lt;/a&gt;)</li>
<li>Peter Eisenegger (<a href="http://www.anec.eu/anec.asp">ANEC</a>)</li>
<li>Peter Eisenegger (<a href="[http://www.anec.eu/anec.asp http://www.anec.eu/anec.asp]">ANEC&lt;/a&gt;)</li>
</ul>
</ul>
</td></tr>
<tr>
<td> Comments<br />
</td>
<td>
<p><br />
</p>
</td></tr></table>
<h2> <span style="font-size: larger; line-height: 1.2">ETSI </span>Cloud Standards Coordination final report v.1.0 </h2>
<table border="1" cellpadding="1" cellspacing="1" width="1071">


<tr>
|-
<td> Context<br />
| Comments<br/>
</td>
|
<td>
 
<p><span style="color:#2C3439">The </span><span style="font-size:13px; color:#20272B">overall objective of the Cloud Standards Coordination initiative led by ETSI is to identify a detailed map of the standards required to support a series of </span><span style="font-size:13px; color:#36568B"><u><a href="http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2012:0529:FIN:EN:PDF">policy objectives</a></u></span><span style="font-size:13px; color:#20272B">&#160;defined by the European Commission, in particular </span><span style="color:#2C3439">in critical areas such as security, interoperability, data portability and reversibility</span><span style="font-size:13px; color:#20272B">.</span>
 
</p>
|}
</td></tr>
 
<tr>
== <span style="font-size: larger;  line-height: 1.2">ETSI </span>Cloud Standards Coordination final report v.1.0 ==
<td> URL
 
</td>
{| border="1" cellpadding="1" cellspacing="1" width="1071"
<td> <a href="http://csc.etsi.org/phase2/UserNeeds.html">http://csc.etsi.org/phase2/UserNeeds.html</a><br />
|-
</td></tr>
| Context<br/>
<tr>
|
<td> Comments<br />
<span style="color:#2C3439">The </span><span style="font-size:13px; color:#20272B">overall objective of the Cloud Standards Coordination initiative led by ETSI is to identify a detailed map of the standards required to support a series of </span><span style="font-size:13px; color:#36568B"><u><a href="[http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2012:0529:FIN:EN:PDF http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2012:0529:FIN:EN:PDF]">policy objectives&lt;/a&gt;</u></span><span style="font-size:13px; color:#20272B">&nbsp;defined by the European Commission, in particular </span><span style="color:#2C3439">in critical areas such as security, interoperability, data portability and reversibility</span><span style="font-size:13px; color:#20272B">.</span>
</td>
 
<td>
|-
<p>[Irene Kamara]
| URL
</p><p>The report includes the collection and classification of over 100 cloud computing Use Cases, many of which have a personal data protection focus (e.g. UC SD 3.3.3. Processing Sensitive Data)
| http://www.etsi.org/images/files/Events/2013/2013_CSC_Delivery_WS/CSC-Final_report-013-CSC_Final_report_v1_0_PDF_format-.PDF<br/>
</p>
|-
</td></tr></table>
| Comments<br/>
<p>&#160;
|
</p>
[Irene Kamara]
 
The report includes the collection and classification of over 100 cloud computing Use Cases, many of which have a personal data protection focus (e.g. UC SD 3.3.3. Processing Sensitive Data)
 
|}
 
&nbsp;

Revision as of 11:06, 6 July 2015

This page focuses on activities related to privacy carried out in the European Standardisation Organisations (ESOs)

<img src="/images/ipen/c/c0/CEN_CENELEC.jpg" _fck_mw_filename="CEN CENELEC.jpg" alt="" /><img src="/images/ipen/b/b3/ETSI.jpg" _fck_mw_filename="ETSI.jpg" alt="" />

CEN-CENELEC JWG8 on Privacy Management of Security Products and Related Services

Context

The European commission has issued in early 2015 a mandate to European Standardisation Organisations (or ESOs), CEN, CENELEC, ETSI) to work on a roadmap of standards covering the privacy management of security products and related services

Consequently, CEN/CENELEC has decided to launch a joint working group JWG8, the secretariat of which will be managed by AFNOR (France).

The objective if to define a roadmap and work plan for October 2015

URL

Mandate page: <a href="http://ec.europa.eu/growth/tools-databases/mandates/index.cfm?fuseaction=search.detail&id=548">http://ec.europa.eu/growth/tools-databases/mandates/index.cfm?fuseaction=search.detail&id=548</a>

JWG8 page: <a href="http://www.cencenelec.eu/standards/Sectors/DefenceSecurityPrivacy/Privacy/Pages/default.aspx">http://www.cencenelec.eu/standards/Sectors/DefenceSecurityPrivacy/Privacy/Pages/default.aspx</a>

Members of JWG8

Working group structure

  • Chair: Claire Waast-Richards (EDF)

Editing team

  • French delegation: Antonio Kung, Mourad Faher, Denis Pinkas
  • German delegation: Matthias Reinis, Kai Rannenberg
  • UK delegation: Alan Shipman, John Mitchell
  • ANEC: Matthias Pocs
  • CEN-CENELEC: Alina Iatan
Comments

[Antonio Kung]

  • During the IPEN workshop it was made clear that the concept of security products should be more clearly defined (in particular on the contradiction between surveillance and privacy)


CEN/TC225 - AIDC technologies

As stated in Wikipedia : Automatic identification and data capture (AIDC) refers to the methods of automatically identifying objects, collecting data about them, and entering that data directly into computer systems (i.e. without human involvement). Technologies typically considered as part of AIDC include bar codes, Radio Frequency Identification (RFID), biometrics, magnetic stripes, Optical Character Recognition (OCR), smart cards, and voice recognition. AIDC is also commonly referred to as “Automatic Identification,” “Auto-ID,” and "Automatic Data Capture."

Data Protection, Privacy and Information Aspects of RFID

Context

In December 2008, the European Commission addressed the Mandate M/436 to CEN, CENELEC and ETSI in the field of ICT as applied to RFID systems. The Mandate M/436 was accepted by the ESOs in the first months of 2009. The Mandate addresses the data protection, privacy and information aspects of RFID, and is being executed in two phases.

Phase 1, completed in May 2011, identified the work needed to produce a complete framework of future RFID standards. The Phase 1 results are contained in the ETSI Technical Report <a href="http://www.etsi.org/deliver/etsi_tr/187000_187099/187020/01.01.01_60/tr_187020v010101p.pdf">TR 187 020</a>, which was published in May 2011.

Phase 2 is concerned with the execution of the standardisation work programme identified in the first phase. This second phase ended in July 2014 with the publication of different technical reports and the publication of two European standards:

<a href="http://standards.cen.eu/dyn/www/f?p=204:110:0::::FSP_PROJECT:38577&cs=1201C63DE7F80DEAB30AE7D3BD4035F0A">EN 16571</a>: « Information technology - RFID privacy impact assessment process» and

<a href="http://standards.cen.eu/dyn/www/f?p=204:110:0::::FSP_PROJECT:38350&cs=117C4B4C6C024833E3B87802F882742D0">EN 16570</a>: « Information technology - Notification of RFID - The information sign and additional information to be provided by operators of RFID application systems».

Here is a powerpoint presentation of TC225 : <a href="http://docbox.etsi.org/Workshop/2013/201301_SECURITYWORKSHOP/03_CENCENELEC_Standardization/CEN_TC225_M436_DESSENNE.pdf">http://docbox.etsi.org/Workshop/2013/201301_SECURITYWORKSHOP/03_CENCENELEC_Standardization/CEN_TC225_M436_DESSENNE.pdf</a>

URL

Mandate page: <a href="http://ec.europa.eu/growth/tools-databases/mandates/index.cfm?fuseaction=search.detail&id=415">M/436</a>

CEN/TC225 page: <a href="http://standards.cen.eu/dyn/www/f?p=204:7:0::::FSP_LANG_ID,FSP_ORG_ID:25,6206&cs=1655B872A8BB9229C9ABA80AB8819C24A#1">CEN/TC225</a>

Members of CEN/TC225

A dedicated Project Team has been appointed to draft the EN 16571 on PIA for RFID applications

Editing team

Comments


ETSI Cloud Standards Coordination final report v.1.0

Context

The overall objective of the Cloud Standards Coordination initiative led by ETSI is to identify a detailed map of the standards required to support a series of <a href="http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2012:0529:FIN:EN:PDF">policy objectives</a> defined by the European Commission, in particular in critical areas such as security, interoperability, data portability and reversibility.

URL http://www.etsi.org/images/files/Events/2013/2013_CSC_Delivery_WS/CSC-Final_report-013-CSC_Final_report_v1_0_PDF_format-.PDF
Comments

[Irene Kamara]

The report includes the collection and classification of over 100 cloud computing Use Cases, many of which have a personal data protection focus (e.g. UC SD 3.3.3. Processing Sensitive Data)