Scenario 12: User Consent to attribute release

One potential way of resolving the conflict between privacy requirements and the need to identify users is to investigate scenarios in which users are asked for their consent to the release of personal information. The DPIE2 (Developing Personalisation for the Information Environment 2) project has considered this (see below), and there are some related current and upcoming JISC ITTs: the Identity Management Toolkit and Personalisation: developing practice for user consent for data , which will look at how user consent might work in a UK HE context.


In SARoNGS, a project that is looking at Shibbolising access to the NGS, the anonymous eduPersonTargetedID supplied by the IdP is linked to an identifier that identifies the user, specifically (in this case) the user’s email address. However, this is requested from the user, not from the IdP (which would in general be unable to supply such personal data).


On a technical note, Shibboleth 2.2 will support attribute release with user consent, based on the SWITCH ArpViewer (ARP = Attribute Release Policy).


Proposed action:


None. This scenario is covered adequately by the current and upcoming JISC ITTs mentioned above.



-1 votes
Idea No. 4