Re: [scim] Discussion Item: Personally Identifiable Information in SCIM

[Danny Mayer <[e-mail]>]

On 11/11/21 10:13 AM, Janelle Allen (janelall) wrote:

> Hi there,
>
> In the IETF session today, Phil mentioned privacy and the handling of 
> PII.  A lot of legislation has occurred since SCIM 2.0. A question to 
> this WG, should we be revisiting the core schema and marking some 
> attributes as potentially containing PII?
>
> This caused me to ponder should we be thinking of modifying the core 
> schema to identify which attributes may carry PII eg: the complex name 
> attribute has the potential to carry PII, should we consider adding a 
> new item as a peer to “mutability” such as “containsPII: true/false”?. 
> Or expand on the returned element such as returned: “restrictedPII”? 
> or any other unmentioned method of addressing PII?
>
I'd like to understand the use case for even providing PII data in SCIM. 
Most of the data that the SCIM Schemas currently are offering (see 
RFC7643) are not PII (though maybe ims and photos might be considered 
PII - Section 4.1.2). Having dealt with HR systems and their API's I 
know that there is only an extremely limited subset of data that should 
ever be made available to any outside system and you don't generally 
want to host it on a management platform if it is PII. I didn't attend 
the meeting so I don't know what the discussion was about. I personally 
feel that PII should NOT be made available through SCIM, but I'm willing 
to be persuaded otherwise as long as PII protections can be defined and 
required in any resulting document.

Danny