Consent and control

Every technique in this chapter serves one goal: information should never move without the person knowing and wanting it to. However good the technology, the final decision is the person's. This page covers where that decision is made: the consent screen, the transaction log and the right to erasure.

The consent screen: three questions

When a verifier asks for information, the wallet shows a screen before sending anything. It answers three questions:

• Who is asking? The verifier's name is read from its record in the network's trust list; a site cannot pick its own name. If the verifier acts for someone else, as an intermediary, both names are shown.
• What are they asking for? The credential and its fields are listed one by one. The person can switch off some fields or refuse altogether.
• Why? The purpose the verifier declared when it registered with the network is shown. A field outside that purpose is flagged separately.

The wallet is the person's tool, not their gatekeeper. Sharing with an unregistered verifier, or beyond the purpose, is still possible, but only after a clear warning, knowingly.

The transaction log: who did I show what to?

The wallet records which fields of which credential were shown, when and to whom. This transaction logtransaction logThe wallet's record of which information was shown to whom and when. stays on the phone; it never goes to Tamga or any other server. If the person wants, they can export it as a file encrypted with a password of their choosing, for example as evidence for a complaint. The export never happens on its own.

The right to erasure

KVKK and the GDPR give people the right to have their data deleted. In Tamga that right shows up in three places:

• Resetting the wallet: all data on the device, and the person's records in Tamga's services (the identity service and the wallet provider), are deleted.
• Deletion requests: from the wallet, the person can ask an institution they shared with to delete their data.
• Complaints: the wallet also shows how to complain to the data protection authority the verifier answers to.

Chapter summary

Privacy is not one feature but a layered design: first shrink what is needed (data minimisation), then open only that (selective disclosure), if possible prove without opening anything (zero-knowledge proofs), stop traces from joining up (unlinkability), and finally leave the decision to the person. The next chapter shows how these ideas became a legal and technical framework in Europe.