Subject: [abfab] Soliciting privacy requirements

From: Josh Howlett <[email-masked]>
Date: Wed, 9 Mar 2011 17:15:19 +0000

I asked a qualified colleague to enumerate the high-level requirements that would allow a federated identity system to /most comprehensively/ address the requirements of the EU data protection regime. Here's what he suggested that the system should ideally provide:

a) release of essential information from the IdP to the RP with notification to user, and
b) seeking of user's consent to release of non-essential information from the IdP to the RP, and
c) provision of information from the user to the RP

It would be entirely possible to construct a system that didn't have all of these properties yet satisfied the EU's DP requirements, but I suggest we aim high as a starting point and pull back if necessary.

Is there anything that anyone would like to add to this list?

Josh.

JANET(UK) is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG

---

From: Sam Hartman <[email-masked]>
Date: Wed, 09 Mar 2011 14:32:35 -0500

I think it would be really good if we could get someone to give a brief
tutorial on why these are requirements.
I certainly wouldn't mind reading a hundred pages or so on EU  privacy
regulations and similar quantities of material on a couple of other
legal environments.
That's not essential: we can go forward with requirements like this.
However I've found that it helps for engineers to understand the
requirements and their motivations when evaluating tradeoffs.

--Sam

---

From: "Cantor, Scott E." <[email-masked]>
Date: Wed, 9 Mar 2011 19:42:12 +0000

> It would be entirely possible to construct a system that didn't have all of
> these properties yet satisfied the EU's DP requirements, but I suggest we
> aim high as a starting point and pull back if necessary.
> 

How high? The best feature Cardspace had, but which it implemented in laughable fashion, was hiding the user's interactions (meaning what RPs the user visited) from the IdP. 

Aiming less high, I think you should at least articulate requirements for pairwise identification, meaning the system shouldn't unavoidably add any cross-RP correlatable data above and beyond what the network layer already does.

-- Scott

---

From: Josh Howlett <[email-masked]>
Date: Wed, 9 Mar 2011 21:34:34 +0000

Sam,

Here are some good starting points:

The UK federation's "Recommendations for Use of Personal Data", which provides a high-level overview:

http://www.ukfederation.org.uk/library/uploads/Documents/recommendations-for-use-of-personal-data.pdf

A set of more general papers discussing the implications of privacy and data protection in the context of federated identity:

http://www.terena.org/activities/refeds/data-protection.html

The directive itself:

http://europa.eu/legislation_summaries/information_society/l14012_en.htm

And its UK implementation, by way of an English-language example: 

http://www.legislation.gov.uk/ukpga/1998/29/contents

The good news is that the principles are very simple, and can be explained in minutes. Unfortunately, although the national implementations are based on the same directive, there is sufficient variation in interpretation, enforcement and culture that can cause some surprises when operating across borders. For example, in the UK we don't have any formal proof of identity (our passport is just a proof of nationality) and tend to take a skeptical view of such things (the fledging national identity register was actually destroyed last month), whereas those crazy Swedes use a single ID to link a number of different public and private services. 

The directive was established in 1995, and it's definitely showing its age. There is an on-going effort to update the directive.

It's a bit late for Prague, but perhaps we could consider a workshop around ABFAB & Privacy in Quebec City?

Josh.