Privacy Req 4 - Revision history

Omaerz: 13 revisions imported: Initial Upload of old pages from IDESG Wiki

2018-06-28T04:03:02Z

13 revisions imported: Initial Upload of old pages from IDESG Wiki

← Older revision	Revision as of 04:03, 28 June 2018
(No difference)

Mary Hodder: added info from linked SG page

2018-06-18T21:58:47Z

added info from linked SG page

← Older revision		Revision as of 21:58, 18 June 2018
Line 14:		Line 14:
	See Requirements [[Privacy Req 1\|PRIVACY-1 (DATA MINIMIZATION)]] and [[Privacy Req 2\|PRIVACY-2 (PURPOSE LIMITATION)]] on the application of limitations to, and scope of, individual transactions and data exchanges.		See Requirements [[Privacy Req 1\|PRIVACY-1 (DATA MINIMIZATION)]] and [[Privacy Req 2\|PRIVACY-2 (PURPOSE LIMITATION)]] on the application of limitations to, and scope of, individual transactions and data exchanges.

	See ~~also~~ [[~~Privacy Req~~ 4 ~~Supplemental~~ Guidance]].		=== Supplemental Information ===

			Credentials bound to identifiers, like attributes bound to identifiers, carry increased risk of inappropriate disclosure when stored. See generally [[Privacy_Req_1\|PRIVACY-1]]. This requirement PRIVACY-4 assumes that the privacy risk analysis required by [[Privacy_Req_5\|PRIVACY-5]] will inform an entity's decisions about credential retention.

			=== References and Guidance (non-normative) ===

			See [[Privacy_Req_2\|PRIVACY-2]] and [[Privacy_Req_3\|PRIVACY-3]].

Mary Hodder: updated SG phase II

2018-06-13T20:39:23Z

updated SG phase II

New page

''<< Back to [[Baseline_Functional_Requirements_v1.0|Baseline Functional Requirements Index]]''

== PRIVACY-4. CREDENTIAL LIMITATION ==
Entities MUST NOT request [[IDEF Glossary USERS|USERS]]’ credentials unless necessary for the transaction and then only as appropriate to the risk associated with the transaction or to the risks to the parties associated with the transaction.

=== SUPPLEMENTAL GUIDANCE ===
Intermediaries may not have a direct relationship with individuals whose data moves through their systems,
but should facilitate endpoints' ability to conform to this Requirement.

See the [https://workspace.idesg.org/kws/public/download.php/53/IDEF-Functional-Model-v1.0.pdf IDESG Functional Model] for definition of Transaction Intermediation for the scope of “intermediaries.” The functional model describes Transaction Intermediation as “Processes and
procedures that limit linkages between transactions and facilitate credential portability." This includes
functions defined as “Blinding,” “Psuedonymization/Anonymization,” and “Exchange.”

See Requirements [[Privacy Req 1|PRIVACY-1 (DATA MINIMIZATION)]] and [[Privacy Req 2|PRIVACY-2 (PURPOSE LIMITATION)]] on the application of limitations to, and scope of, individual transactions and data exchanges.

See also [[Privacy Req 4 Supplemental Guidance]].

=== REFERENCES ===
Further reference materials to aid organizations interested in conforming to these Requirements can be found at the wiki page [[Supplemental Privacy Guidance]]; this has been archived at https://workspace.idesg.org/kws/public/download.php/56/Supplemental-Privacy-Guidance.docx

=== APPLIES TO ROLES ===
1 - [[IDEF Glossary RELYING PARTIES|RELYING PARTIES]] 
2 - [[IDEF Glossary IDENTITY PROVIDERS|IDENTITY PROVIDERS]] 
3 - Attribute Providers 
4 – Intermediaries 
5 - Credential Service Providers (where there is user interaction) 

=== APPLIES TO ACTIVITIES ===
[[IDEF Functional Model REGISTRATION|REGISTRATION]], [[IDEF Functional Model CREDENTIALING|CREDENTIALING]], [[IDEF Functional Model AUTHENTICATION|AUTHENTICATION]], [[IDEF Functional Model AUTHORIZATION|AUTHORIZATION]], [[IDEF Functional Model INTERMEDIATION|INTERMEDIATION]]

=== KEYWORDS ===
[[IDEF Keywords CREDENTIAL|CREDENTIAL]], [[IDEF Keywords IDENTIFIERS|IDENTIFIER]], [[IDEF Keywords LIMITATION|LIMITATION]],
[[IDEF Keywords PRIVACY|PRIVACY]], [[IDEF Keywords PURPOSE|PURPOSE]], [[IDEF Keywords RISK|RISK]]

----
----
Quick Links: [[SALS]] | [[Baseline Functional Requirements v1.0]] | [[Glossary]] |

----
----