Documenting the same attribute in different ways (based on perspective) is a receipt for disaster.
Everybody should call it in the same way; the IdP, the SP, the federation, the government and software developers. An attribute is pseudonymous from the SP perspective, too.
(The attribute can be more anonymous than pseudonymous, there are other words for that, for example transient, when it's session based.)
Kind regards, Meshna
Meshna Koren
Associate Product Manager Product Management - Identity and Platform - Research Products
Elsevier BV Radarweg 29, Amsterdam 1043 NX, The Netherlands m.koren@elsevier.com
Federated Access - SAML, Shibboleth, Corporate SSO, OpenAthens, Institutional Login
-----Original Message----- From: FIM4L fim4l-bounces@lists.daasi.de On Behalf Of Jos Westerbeke Sent: Monday, July 22, 2019 08:34 To: fim4l@lists.daasi.de Subject: Re: [Fim4l] Scopus
*** External email: use caution ***
Op 20-07-19 13:25 heeft FIM4L namens Peter Schober <fim4l-bounces@lists.daasi.de namens peter.schober@univie.ac.at> geschreven:
Nit: If the SP recieves a persistent identifier (i.e., one that doesn't change from session to session) the subject is not "anonymous" but merely "pseudonymous", at least under GDPR terminology. (This matters to those of us that have to compy with GDPR because "anonymous data" isn't personal data and doesn't fall under GDPR, but "pseudonymous" is personal data just as if it were not pseudonymised.)
Can't we say that, with regard to a persistent identifier, - for an IdP it is pseudonymous (for they can translate it to a person) - for an SP it is anonymous (for they are not able to translate it to a person)?
regards, Jos
_______________________________________________ FIM4L mailing list FIM4L@lists.daasi.de http://lists.daasi.de/listinfo/fim4l
________________________________
Elsevier B.V. Registered Office: Radarweg 29, 1043 NX Amsterdam, The Netherlands, Registration No. 33156677, Registered in The Netherlands.