Privacy Req 3 - Revision history

Omaerz: 14 revisions imported: Initial Upload of old pages from IDESG Wiki

2018-06-28T04:03:01Z

14 revisions imported: Initial Upload of old pages from IDESG Wiki

← Older revision	Revision as of 04:03, 28 June 2018
(No difference)

Mary Hodder: added info from linked page for SG

2018-06-18T21:57:20Z

added info from linked page for SG

← Older revision		Revision as of 21:57, 18 June 2018
Line 15:		Line 15:
	For example, an attribute could be a birth date and a claim could be “old enough to buy alcohol beverage in the state of WA”.		For example, an attribute could be a birth date and a claim could be “old enough to buy alcohol beverage in the state of WA”.

	~~See~~ also [[~~Privacy Req 3 Supplemental Guidance~~]].		=== Supplemental Information ===

			IDENTITY-PROVIDERS (and any other entities releasing attributes MUST provide the opportunity for attributes to be released as claims as well as detailed attributes; see also [[Privacy_Req_1\|PRIVACY-1]] on granularity of requests to support data minimization by requesters, generally.

			Attribute providers may be required by their own business processes to collect and store, although not necessarily transmit, attributes in their attribute form, in which case significant alteration or filtering may be required when that data is re-used or transmitted to others.

			=== References and Guidance (non-normative) ===

			* NIST SP 800-162: Attribute Based Access Control Definition and Considerations (2014), pages 26, 28, 31: http://csrc.nist.gov/publications/nistpubs/800-162/sp800_162_pre-publication.pdf


	=== REFERENCES ===		=== REFERENCES ===

Mary Hodder: /* SUPPLEMENTAL GUIDANCE */

2018-06-13T20:36:37Z

SUPPLEMENTAL GUIDANCE

← Older revision		Revision as of 20:36, 13 June 2018
Line 9:		Line 9:
	(DATA MINIMIZATION)]] on granularity of requests to support data minimization by requesters, generally.		(DATA MINIMIZATION)]] on granularity of requests to support data minimization by requesters, generally.

	Attribute providers may be required by their own business processes to collect and store, although		Attribute providers may be required by their own legal or business processes to collect and store, although
	not necessarily transmit, attributes in their attribute form, in which case significant alteration or		not necessarily transmit, attributes in their attribute form, in which case significant alteration or
	filtering may be required when that data is re-used or transmitted to others.		filtering may be required when that data is re-used or transmitted to others.

Mary Hodder: Added SG and Roles.

2018-06-13T20:35:53Z

Added SG and Roles.

New page

''<< Back to [[Baseline_Functional_Requirements_v1.0|Baseline Functional Requirements Index]]''

== PRIVACY-3. ATTRIBUTE MINIMIZATION ==
Entities requesting [[IDEF Glossary ATTRIBUTES|attributes]] MUST evaluate the need to collect specific attributes in a transaction, as opposed to claims regarding those attributes. Wherever feasible, entities MUST collect, generate, use, transmit, and store claims about [[IDEF Glossary USERS|USERS]] rather than attributes. Wherever feasible, attributes MUST be transmitted as claims, and transmitted credentials and identities MUST be bound to claims instead of actual attribute values.

=== SUPPLEMENTAL GUIDANCE ===
Where feasible, Identity Providers (and any other entities releasing attributes) should provide the
opportunity for attributes to be released as claims as well as detailed attributes; see also [[Privacy Req 1|PRIVACY-1
(DATA MINIMIZATION)]] on granularity of requests to support data minimization by requesters, generally.

Attribute providers may be required by their own business processes to collect and store, although
not necessarily transmit, attributes in their attribute form, in which case significant alteration or
filtering may be required when that data is re-used or transmitted to others.

For example, an attribute could be a birth date and a claim could be “old enough to buy alcohol beverage in the state of WA”.

See also [[Privacy Req 3 Supplemental Guidance]].

=== REFERENCES ===
Further reference materials to aid organizations interested in conforming to these Requirements can be found at the wiki page [[Supplemental Privacy Guidance]]; this has been archived at https://workspace.idesg.org/kws/public/download.php/56/Supplemental-Privacy-Guidance.docx

=== APPLIES TO ROLES ===
1 - [[IDEF Glossary RELYING PARTIES|RELYING PARTIES]] 
2 - [[IDEF Glossary IDENTITY PROVIDERS|IDENTITY PROVIDERS]] 
3 - Attribute Providers 
4 – Intermediaries 
5 - Credential Service Providers (where there is user interaction) 

=== APPLIES TO ACTIVITIES ===
[[IDEF Functional Model REGISTRATION|REGISTRATION]], [[IDEF Functional Model CREDENTIALING|CREDENTIALING]], [[IDEF Functional Model AUTHENTICATION|AUTHENTICATION]], [[IDEF Functional Model AUTHORIZATION|AUTHORIZATION]], [[IDEF Functional Model INTERMEDIATION|INTERMEDIATION]]

=== KEYWORDS ===
[[IDEF Keywords ATTRIBUTES|ATTRIBUTE]], [[IDEF Keywords IDENTIFIERS|IDENTIFIER]], [[IDEF Keywords LIMITATION|LIMITATION]], [[IDEF Keywords MINIMIZATION|MINIMIZATION]], [[IDEF Keywords PRIVACY|PRIVACY]]

----
----
Quick Links: [[SALS]] | [[Baseline Functional Requirements v1.0]] | [[Glossary]] |

----
----