https://wiki.idesg.org/index.php?action=history&feed=atom&title=Privacy_Req_9 2026-05-06T10:00:04Z Revision history for this page on the wiki MediaWiki 1.38.4 https://wiki.idesg.org/index.php?title=Privacy_Req_9&diff=5915&oldid=prev 2018-06-28T04:03:05Z

<p>9 revisions imported: Initial Upload of old pages from IDESG Wiki</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <tr class="diff-title" lang="en"> <td colspan="1" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="1" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 04:03, 28 June 2018</td> </tr><tr><td colspan="2" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div> </td></tr></table>

Omaerz https://wiki.idesg.org/index.php?title=Privacy_Req_9&diff=5914&oldid=prev 2018-06-13T20:44:57Z

<p>updated SG for phase II</p> <p><b>New page</b></p><div>&#039;&#039;&lt;&lt; Back to [[Baseline_Functional_Requirements_v1.0|Baseline Functional Requirements Index]]&#039;&#039;<br /> <br /> == PRIVACY-9. USER NOTICE OF CHANGES ==<br /> Entities MUST, upon any material changes to a service or process that affects the prior or ongoing collection, generation, use, transmission, or storage of [[IDEF Glossary USERS|USERS]]’ <br /> [[IDEF Glossary PERSONAL INFORMATION|personal information]], notify those USERS, and provide them with compensating controls designed to mitigate privacy risks that may arise from those changes, which may include seeking express affirmative consent of USERS in accordance with relevant law or regulation.<br /> <br /> === SUPPLEMENTAL GUIDANCE ===<br /> Once USERS have been notified of the planned uses and processing of their personal information<br /> (see [[Privacy Req 6|PRIVACY 6 (USAGE NOTICE)]]), and exercised whatever consent, limitation or withdrawal rights they<br /> have (see [[Privacy Req 7|PRIVACY-7 (USER DATA CONTROL)]]), material changes to those uses or processing may render<br /> their choices obsolete, so entities should refresh the USER&#039;s opportunity to exercise those controls in<br /> light of the new information. (See [[Usable Req 4|USABLE-4 (NAVIGATION)]], [[Usable Req 5|USABLE-5 (ACCESSIBILITY)]] and [[Usable Req 6|USABLE-6<br /> (USABILITY FEEDBACK)]].)<br /> <br /> Regarding &quot;personal information&quot;, see [[APPENDIX_A-Defined_Terms|Appendix A]], and [[Privacy Req 1|PRIVACY-1 (DATA MINIMIZATION)]].<br /> <br /> “Express affirmative consent” should not be used to mitigate privacy risks created by technical<br /> architecture or design, or to mitigate risks that individuals could not be reasonably expected to be able<br /> to assess; see [[Privacy Req 5|PRIVACY-5 (DATA AGGREGATION RISK)]].<br /> <br /> “Compensating controls” are controls or mechanisms, which may operate either by policy or<br /> (preferably) technology, designed to mitigate privacy risks that may arise when a material change is<br /> made to the system. Examples might include an opportunity to assent or withdraw, or risk-shifting<br /> rules occurring upon a change. Those controls can be under user administration, but only if the user<br /> can be reasonably expected to understand how to use those mechanisms to effectively mitigate their<br /> risk.<br /> <br /> The Kantara Consent Receipt is now available (January 2018) in draft form at https://groups.google.com/forum/#!topic/wg-infosharing/553qIdgaq0o<br /> <br /> === REFERENCES ===<br /> Further reference materials to aid organizations interested in conforming to these Requirements can be found at the wiki page [[Supplemental Privacy Guidance]]; this has been archived at https://workspace.idesg.org/kws/public/download.php/56/Supplemental-Privacy-Guidance.docx<br /> <br /> === APPLIES TO ACTIVITIES ===<br /> [[IDEF Functional Model REGISTRATION|REGISTRATION]], [[IDEF Functional Model CREDENTIALING|CREDENTIALING]], [[IDEF Functional Model AUTHENTICATION|AUTHENTICATION]], [[IDEF Functional Model AUTHORIZATION|AUTHORIZATION]], [[IDEF Functional Model INTERMEDIATION|INTERMEDIATION]]<br /> <br /> === KEYWORDS ===<br /> [[IDEF Keywords CHANGES|CHANGES]], [[IDEF Keywords CONSENT|CONSENT]], [[IDEF Keywords NOTICE|NOTICE]], [[IDEF Keywords PRIVACY|PRIVACY]], [[IDEF Keywords PURPOSE|PURPOSE]]<br /> <br /> === APPLIES TO ROLES ===<br /> 1 - [[IDEF Glossary RELYING PARTIES|RELYING PARTIES]] &lt;br&gt;<br /> 2 - [[IDEF Glossary IDENTITY PROVIDERS|IDENTITY PROVIDERS]] &lt;br&gt;<br /> 3 - Attribute Providers &lt;br&gt;<br /> 4 – Intermediaries &lt;br&gt;<br /> 5 - Credential Service Providers (where there is user interaction) &lt;br&gt;<br /> <br /> ----<br /> ----<br /> Quick Links: [[SALS]] | [[Baseline Functional Requirements v1.0]] | [[Glossary]] |<br /> <br /> ----<br /> ----</div>

Mary Hodder