Hello fim4l,

I am a recent member of this list, and am writing to introduce myself. I am the CTO and director of technology for the Stanford University Libraries; I helped draft the "Stanford statement" on privacyhttps://library.stanford.edu/using/special-policies/statement-patron-privacy-and-database-access and have been tracking (and commenting on) the RA21 draft specifications.

This list came to my attention after one of the current members (hi Jos) reached out to a colleague after the Stanford statement was published, and after fim4l was highlighted in discussions of RA21 with members of the Ivy Plus Libraries Confederation in the US. (Hi Heather.)

I have been following the discussion on this list for the last month, and have found it quite illuminating.

First off, thank you for doing this work; not enough attention has been paid to bridging the business concerns of libraries with the technology and power offered by federated identity management.

Second, I am pleased that as with GDPR, Europe is perhaps more advanced than the US in these matters. I hope those of us from US institutions might benefit from your work, and also contribute to the discussions.

Third, I have made several suggestions and comments on the draft guidelines & recommendationshttps://docs.google.com/document/d/1pIaEXfw9ZWnXM4p6Dd2Lri7RFWKgr7ObKLEGfUy2nck/edit#. I hope they are useful. In some cases, the suggestions may be questions, or comments based on uncertainty around some of the intricacies of attributes.

Finally, from a library and privacy perspective, I believe both the list discussion and the draft recommendations would benefit by focusing on establishing a minimal set of attributes to be released, and then exploring how individual users might explicitly allow more sharing of attributes through their IdP (such as Duke University has developed), or through decoration of a user profile by the user post-authn.

Best regards,

- Tom

| Tom Cramer | Associate University Librarian | Director, Digital Library Systems & Services | Chief Technology Strategist | Stanford University Libraries | tcramer@stanford.edumailto:tcramer@stanford.edu