Digital Credentials
Enabling Mobility
and Verification of
Educational
Achievements
Brandon Muramatsu, MIT
Willem van Valkenburg, Delft University of Technology

Today● A brief intro to the Digital Credentials
Consortium● Two case studies○ GDPR and Digital Credentials, Delft University ofTechnology○ Open Source Learner Credential Wallet, MIT

Digital Credentials Consortium
Our mission is to create a trusted,
distributed, and shared infrastructurethat will become the standard for issuing,
storing, displaying, and verifying
academic credentials, digitally.

DCC Founding Members
Delft University of Technology (TheNetherlands)
Georgia Institute of Technology (USA)Harvard University (USA)
Hasso Plattner Institute, University ofPotsdam (Germany)

Tecnológico De Monterrey (Mexico)
Technical University of Munich(Germany)
University of California at Berkeley(USA)
University of California, Irvine (USA)

Massachusetts Institute of Technology(USA)

University of Milano-Bicocca (Italy)

McMaster University (Canada)

University of Toronto (Canada)

DCC Guiding Principles
Learners●●●●Learners retain primary control
over their credentials.
Learners’ consent is required forissuance of digital credentials.
Learners decide to whom they grantaccess.
Barriers to receiving and managing
credentials are minimal to enablebroad participation.

Issuers●●●Issuers control to whom they issue
credentials, the particular achievementthat the credential represents, andwhich credential options are available
to the learner.
Issuers can revoke credentials
according to their institution’s policies.
Barriers to issuing credentials areminimal to enable broad and diverse
participation.

Trust:● Everyone is able to review how the infrastructure and processes work.
● Trust in the integrity of the credentials is established cryptographically.
● Credentials can be verified without consulting the original issuer.

How does DCC do its work?
● Consortium of members with alignment to guiding principles,and each working in similar ways on digital credentials● DCC does its work through open standards organizations
primarily the W3C Verifiable Credentials for Education(W3C VC-EDU) Community Group○ Coordinates with IMS Global on Comprehensive Learner Record
and Open Badges v3 specifications● Shared technical work through a Technical Working Groupmade up of DCC members● Implementing Verifiable Credentials (VC) andDecentralized Identifiers (DID) specifications○ Meet key DCC guiding principles of learner control

Delft University of Technology

General Data
Protection Regulation
and Blockchain

General Data Protection Regulation(GDPR)The European Union's General Data Protection Regulation become binding inMay 2018.
Goal of GDPR:
1. to facilitate free movement of personal data between EU members states
2. to establish a framework of fundamental data rights protection.
The legal framework creates a number of obligations resting on data controllers(entities determining the means and purpose of data processing)
The legal framework creates a number of rights to data subjects (the natural
persons to whom the personal data relates) to be enforced by data controllers.
E.g. Article 16 GDPR – right to rectification, Article 17 GDPR – right to erasure(‘right to be forgotten’)Leading principles of GDPR
Lawfulness, fairness
and transparency

organisations need to make sure their data collection practices don’t break the law and that they
aren’t hiding anything from data subjects.

Purpose limitation

Organisations should only collect personal data for a specific purpose, clearly state what that
purpose is, and only collect data for as long as necessary to complete that purpose.

Data minimisation

Organisations must only process the personal data that they need to achieve its processing
purposes.

Accuracy

The accuracy of personal data is integral to data protection. The GDPR states that “everyreasonable step must be taken” to erase or rectify data that is inaccurate or incomplete.

Storage limitation

Organisations need to delete personal data when it’s no longer necessary.

Integrity andconfidentiality(security)

Personal data should be processed in a manner that ensures appropriate security of thepersonal data, including protection against unauthorised or unlawful processing and against
accidental loss, destruction or damage, using appropriate technical or organisational measures.

Accountability

The controller shall be responsible for, and be able to demonstrate compliance with the above
principles

Source:https://www.bankinghub.eu/banking/finance-risk/gdprdeep-dive-implement-right-forgotten

GDPR and Blockchain
The GDPR is based on assumptions that creates tension with blockchain.
GDPR

Blockchain

in relation to each personal data point there is atleast one natural or legal person – the data
controller – whom the subjects can address toenforce their rights under EU Data protection law.

decentralizes to many actors and allocation ofresponsibility and accountability is burdensome.

data can be modified or erased where necessary tocomply with the legal requirements of GDPR Article
16 (right to rectification) and 17 (right to erasure(‘right to be forgotten’)Modification and erasure of data is made onerous toensure data integrity and increase trust in thenetwork.

Personal data on the Blockchain?
In the pilot we explored the following:● Is data that is encrypted or hashed/ ‘anonymized’ still
quality as personal data as per the GDPR requirements ofanonymisation?
● How is the right to erasure/right to be forgotten dealt with inthe pilot?

The right to be forgotten is not an absoluteright●if a learner requests to be forgotten, Accredify
deletes their personal data. The learner is theone who should contact institutes where they
have personally shared their opencert filewhich could be still verified.
● What happens now is that Accredify deletes
personal data from their system which is
GDPR complaint. This is because the right tobe forgotten does not extend to all theinstitutes where the learner shared their file.
● If a certificate is revoked and cannot be
verified in the future that doesn’t say much –so it is good to add an explanation.

Hashing, salt and peppering of personaldata● As long as the hash relates to something it is notanonymised.
● This is the current conflict within blockchain and GDPR
and the interpretation of what is considered asanonymous.

Open Source Learner Wallet
MITMIT Team
Brandon Muramatsu
Philipp Schmidt
Gillian Walsh
Dmitri Zagidulin

About the Open Source Learner Wallet Project● A key missing ingredient in a digital credential infrastructure○○○

Prioritizes learner agency
Enables trust
Supports diverse institutions● A learner credential wallet specification (May 2021)● An open source learner wallet mobile app, eduWallet● A pilot with U.S. institutions:○○College Unbound, Georgia Tech and San Jose City College
MIT xPRO and University of North Texas / Concentric Sky

Details on eduWallet
An Open Source Learner Wallet● Both Android and iOS versions○

Going into pilot testing December 2021–January 2022○○

Login to secure wallet
Add verifiable credentials via deep link (direct and QR Code) andvia QR code
Display credentials locally—Issuer, issuer logo, credential name,issuance date
Select and share credentials as JSON-LD via operating systemsharing mechanisms (copy to clipboard, save as file)
Delete credentials, backup and restore from file

● Key features

○○
○

Demo
● Login to a LMS or student portal● Prompted to install eduWallet from Apple or
Google Play app stores● First time setup of eduWallet● (Simulated) Access credential via LMS / QR Code/ Deep Link
● (Not demonstrated) Authenticate before
receiving credential● View credentials (and share them)Questions?
Brandon Muramatsu
mura@mit.edu

Willem van Valkenburg
w.f.vanvalkenburg@tudelft.nl