[privacydir] [abfab] A proposal for dealing with EU data protection & identifiers (fwd)

[Lucy Lynch <[e-mail]>]

forwarded for your information

- Lucy

---------- Forwarded message ----------
Date: Mon, 7 Mar 2011 21:15:51 +0000
From: Josh Howlett <[e-mail]>
To: "[e-mail]" <[e-mail]>
Cc: Josh Howlett <[e-mail]>
Subject: [abfab] A proposal for dealing with EU data protection & identifiers

I admit that this is likely to be something of a minority interest. It's hard 
to get people excited about privacy and data protection law and identifiers.

However, I claim that it this an important problem to solve. Unfortunately, 
understanding this requirement requires some knowledge of the implications of 
EU data protection law on federated identity before. I provide a brief summary 
below, before setting out my proposal.

** Problem description **

Very frequently, a relying party will want a unique identifier for a user. Such 
identifiers are very useful for recognition (knowing that a user is the same as 
one seen previously) and accountability (so that abuse, etc, can be tracked).

Within federations today, it is common for identity providers to release these 
identifiers to relying parties. These identifiers may name a user explicitly 
(e.g. taking a value of an email address), but other identifiers can name a 
user pseudonymously (e.g. by taking an opaque value) to improve privacy.

The release of these identifiers often have legal implications. The EU data 
protection regime treats all such identifiers as 'personally identifiable 
information', because it can be linked directly or indirectly to a person.

One of the practical consequences of this (within the EU) is that it is highly 
desirable to have a legal contract between the issuer and consumer of an 
identifier. By default the IdP will be responsible for all misuse of the 
identifier by the RP, with civil and/or criminal implications depending on the 
EU member state in question.

A contract is not an onerous requirement if -- for example -- the RP is 
formally providing some kind of service or content to the IdP organisation; 
there will generally be a contract to control that business relationship 
regardless.

However, increasingly a user may want access to an RP that his IdP has no 
relationship with; and often that RP will want an identifier. Unfortunately, 
addressing the general case (pairwise contracts between all IdPs and all SPs in 
federation) creates a legal scalability problem that people involved in EU 
federation policy and governance get fairly exercised about.

User consent is sometimes invoked as a mechanism for addressing identifier 
release to 'unknown' RPs, but in general it's not a useful strategy within the 
EU (though it might be fine in other jurisdictions).

There are other approaches that use umbrella legal structures to control the 
risk, but EU member states take different views on the appropriateness of these 
structures, and so they are not generally universally applicable.

In summary it would be ideal if the RP could be provisioned with an identifier 
without invoking the EU data protection regime, at all.

** Proposal **

It turns out that the EU data protection regime does not have any opinions 
about an IdP either confirming or denying if an identifier is associated with a 
user.

Thus, it appears that it is possible to entirely sidestep the data protection 
regime by having the RP pose the question "please confirm that it is reasonable 
for this user to claim the identifier FOO", rather than the more conventional 
request "please provide an identifier for this user".

I don't know if this is true for other jurisdictions other than the EU. If 
anyone else also has access to lawyers with DP knowledge of other 
jurisdictions, it would be wonderful if you could bounce this approach off 
them. I'm currently working on the assumption that, because the EU DP regime is 
one of the more difficult (or so I understand), it should work elsewhere, but 
that's purely an assumption. The more educated opinions, the better.

Therefore, my proposal is that we should seek to model identifier assignment 
using a 'confirmation' model, rather than the conventional 'release' model.

I believe the semantics of the identifier confirmation model should be:

Acceptor: "Is the identifier FOO associated with a user that you know about?". 
IdP: "Confirm", "Deny", "Neither Confirm Nor Deny".

The value of FOO would be asserted by the initiator to the acceptor. It would 
take an opaque value that the IdP can verify is only likely to have been 
generated by a user that it knows about. The value should generally be 
permanent, but it should also be possible to change it on a per-acceptor basis 
if necessary.

We have some existing components in the ABFAB toolbox that I believe we can 
re-use to avoid creating significant work. Sam and I bounced around a few ideas 
earlier this morning, but as a first step we thought it would be useful to know 
what the WG thinks of this as a general strategy.

Josh.



JANET(UK) is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG

_______________________________________________
abfab mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/abfab