Privacy Req 1 - Revision history

Omaerz: 25 revisions imported: Initial Upload of old pages from IDESG Wiki

2018-06-28T04:02:56Z

25 revisions imported: Initial Upload of old pages from IDESG Wiki

← Older revision	Revision as of 04:02, 28 June 2018
(No difference)

Mary Hodder: /* REFERENCES */ fixed text explanation

2018-06-20T20:12:26Z

REFERENCES: fixed text explanation

← Older revision		Revision as of 20:12, 20 June 2018
Line 25:		Line 25:
	* See Privacy & Biometrics: Building a Conceptual Foundation: Data [p46], Audit [p47].		* See Privacy & Biometrics: Building a Conceptual Foundation: Data [p46], Audit [p47].

	Further reference materials to aid organizations interested in conforming to these Requirements can be found at the wiki page [[Privacy References and Guides]]; this has been archived at https://workspace.idesg.org/kws/public/download.php/56/Supplemental-Privacy-Guidance.docx		Further reference materials to aid organizations interested in conforming to these Requirements can be found at the wiki page [[Privacy References and Guides]]; this page is a living document from the Privacy Committee, and as such will be added to over time. It has been archived at https://workspace.idesg.org/kws/public/download.php/56/Supplemental-Privacy-Guidance.docx

	=== APPLIES TO ACTIVITIES ===		=== APPLIES TO ACTIVITIES ===

Mary Hodder: /* REFERENCES */ updated page name

2018-06-20T20:11:00Z

REFERENCES: updated page name

← Older revision		Revision as of 20:11, 20 June 2018
Line 25:		Line 25:
	* See Privacy & Biometrics: Building a Conceptual Foundation: Data [p46], Audit [p47].		* See Privacy & Biometrics: Building a Conceptual Foundation: Data [p46], Audit [p47].

	Further reference materials to aid organizations interested in conforming to these Requirements can be found at the wiki page [[~~Supplemental~~ Privacy ~~Guidance~~]]; this has been archived at https://workspace.idesg.org/kws/public/download.php/56/Supplemental-Privacy-Guidance.docx		Further reference materials to aid organizations interested in conforming to these Requirements can be found at the wiki page [[Privacy References and Guides]]; this has been archived at https://workspace.idesg.org/kws/public/download.php/56/Supplemental-Privacy-Guidance.docx

	=== APPLIES TO ACTIVITIES ===		=== APPLIES TO ACTIVITIES ===

Mary Hodder: syntax update

2018-06-18T17:51:04Z

syntax update

← Older revision		Revision as of 17:51, 18 June 2018
Line 31:		Line 31:

	=== APPLIES TO ROLES ===		=== APPLIES TO ROLES ===
	~~1 -~~ Relying Parties ~~<br>~~		Relying Parties, Identity Providers, Attribute Providers, Intermediaries, Credential Service Providers (where there is user interaction) <br>
	~~2 -~~ Identity Providers ~~<br>~~
	~~3 -~~ Attribute Providers ~~<br>~~
	~~4 –~~ Intermediaries ~~<br>~~
	~~5 -~~ Credential Service Providers (where there is user interaction) <br>


	=== KEYWORDS ===		=== KEYWORDS ===

Mary Hodder: added Supplemental info from the other appendix A SG

2018-06-18T17:30:58Z

added Supplemental info from the other appendix A SG

← Older revision		Revision as of 17:30, 18 June 2018
Line 13:		Line 13:
	The boundaries of a TRANSACTION between an entity and a user are defined during the interchange where the user is identified to the entity (for example from signin to signout of the user.) See [[Privacy Req 2\|PRIVACY-2 (PURPOSE LIMITATION)]].		The boundaries of a TRANSACTION between an entity and a user are defined during the interchange where the user is identified to the entity (for example from signin to signout of the user.) See [[Privacy Req 2\|PRIVACY-2 (PURPOSE LIMITATION)]].

	See ~~also~~ [[~~Privacy Req 1 Supplemental Guidance~~]].		=== Supplemental Information ===

			IDENTITY PROVIDERS and RELYING PARTIES which employ intermediaries are responsible for the actions of those intermediaries on their behalf, MUST implement protocols that mitigate the risk of intermediaries collecting personal information. See [[Interop_Req_8\|INTEROP-8]] and [[Interop_Best_Practice_E\|INTEROP-BP-E]].

	=== REFERENCES ===		=== REFERENCES ===
			References and Guidance (non-normative)

			* See ISO/IEC 29100 (2011) Privacy Framework, Section 5.5 ("Data minimization").
			* See the HIPAA regulations for health care transactions, 45 CFR Part 164, at §§ 164.502(b) and 164.514(d): "minimum necessary" disclosure standard.
			* See AICPA/CICA Privacy Maturity Model based on GAPP [Collection 4.1.X] (chart)
			* See Privacy & Biometrics: Building a Conceptual Foundation: Data [p46], Audit [p47].

	Further reference materials to aid organizations interested in conforming to these Requirements can be found at the wiki page [[Supplemental Privacy Guidance]]; this has been archived at https://workspace.idesg.org/kws/public/download.php/56/Supplemental-Privacy-Guidance.docx		Further reference materials to aid organizations interested in conforming to these Requirements can be found at the wiki page [[Supplemental Privacy Guidance]]; this has been archived at https://workspace.idesg.org/kws/public/download.php/56/Supplemental-Privacy-Guidance.docx

Mary Hodder: Added roles

2018-06-13T20:31:46Z

Added roles

← Older revision		Revision as of 20:31, 13 June 2018
Line 20:		Line 20:
	=== APPLIES TO ACTIVITIES ===		=== APPLIES TO ACTIVITIES ===
	[[IDEF Functional Model REGISTRATION\|REGISTRATION]], [[IDEF Functional Model CREDENTIALING\|CREDENTIALING]], [[IDEF Functional Model AUTHENTICATION\|AUTHENTICATION]], [[IDEF Functional Model AUTHORIZATION\|AUTHORIZATION]], [[IDEF Functional Model INTERMEDIATION\|INTERMEDIATION]]		[[IDEF Functional Model REGISTRATION\|REGISTRATION]], [[IDEF Functional Model CREDENTIALING\|CREDENTIALING]], [[IDEF Functional Model AUTHENTICATION\|AUTHENTICATION]], [[IDEF Functional Model AUTHORIZATION\|AUTHORIZATION]], [[IDEF Functional Model INTERMEDIATION\|INTERMEDIATION]]

			=== APPLIES TO ROLES ===
			1 - Relying Parties <br>
			2 - Identity Providers <br>
			3 - Attribute Providers <br>
			4 – Intermediaries <br>
			5 - Credential Service Providers (where there is user interaction) <br>


	=== KEYWORDS ===		=== KEYWORDS ===

Mary Hodder: /* SUPPLEMENTAL GUIDANCE */ updated for phase II

2018-06-13T20:29:48Z

SUPPLEMENTAL GUIDANCE: updated for phase II

New page

''<< Back to [[Baseline_Functional_Requirements_v1.0|Baseline Functional Requirements Index]]''

== PRIVACY-1. DATA MINIMIZATION ==
Entities MUST limit the collection, use, transmission and storage of [[IDEF Glossary PERSONAL INFORMATION|personal information]] to the minimum necessary to fulfill that transaction’s purpose and related legal requirements. Entities providing claims or attributes MUST NOT provide any more personal information than what is requested. Where feasible, [[IDEF Glossary IDENTITY PROVIDERS|IDENTITY-PROVIDERS]] MUST provide technical mechanisms to accommodate information requests of variable granularity, to support data minimization.

=== SUPPLEMENTAL GUIDANCE ===
Regarding "personal information," see [[APPENDIX_A-Defined_Terms|Appendix A]].

This requirement limiting the collection, use and storage will apply to every transaction where user private information is exchanged. [Entities are encouraged to address this issue by design, before run time, by limiting or applying controls or filters to classes of data.]

This requirement limiting the provisioning of personal information applies to the entire lifetime of data on the entity’s site.

The boundaries of a TRANSACTION between an entity and a user are defined during the interchange where the user is identified to the entity (for example from signin to signout of the user.) See [[Privacy Req 2|PRIVACY-2 (PURPOSE LIMITATION)]].

See also [[Privacy Req 1 Supplemental Guidance]].

=== REFERENCES ===
Further reference materials to aid organizations interested in conforming to these Requirements can be found at the wiki page [[Supplemental Privacy Guidance]]; this has been archived at https://workspace.idesg.org/kws/public/download.php/56/Supplemental-Privacy-Guidance.docx

=== APPLIES TO ACTIVITIES ===
[[IDEF Functional Model REGISTRATION|REGISTRATION]], [[IDEF Functional Model CREDENTIALING|CREDENTIALING]], [[IDEF Functional Model AUTHENTICATION|AUTHENTICATION]], [[IDEF Functional Model AUTHORIZATION|AUTHORIZATION]], [[IDEF Functional Model INTERMEDIATION|INTERMEDIATION]]

=== KEYWORDS ===
[[IDEF Keywords LIMITATION|LIMITATION]], [[IDEF Keywords MINIMIZATION|MINIMIZATION]], [[IDEF Keywords PRIVACY|PRIVACY]], [[IDEF Keywords PURPOSE|PURPOSE]]

----
----
Quick Links: [[SALS]] | [[Baseline Functional Requirements v1.0]] | [[Glossary]] |

----
----