GEANT Code of Conduct and REFEDS Research and Scholarship compared Attribute release training 15 June 2015

What is the diference? The Code of Conduct is designed to help IdPs feel more comfortable with the SPs intentions to abide by existing data protection law and therefore have relationship with them and works with all types of service providers. It does not define an explicit attribute list and does not work outside of Europe (EU/EEA) in its current form. R&S is designed to help IdPs that are struggling to define any sort of attribute release policies have an easier way of mitigating the risk and designing policies for a small subset of Service Providers that have been through some minimal vetting for specific attributes. It can be used by any federation globally.

GEANT Code of Conduct and REFEDS Research and Scholarship compared GEANT CoCo REFEDS R&S Legal starting point EU data protection directive Focus on “legitimate interests’` justification of EU DPD Geographical coverage SPs in EEA or the EC whitelist of countries Risk assessment rather than geo-boundary Legal shape Contractual obligation binding for the SP Self declared – assessed by federation Who asserts conformance? The SP The SP’s Home federation Service provider type Not limited Research and scholarship services

Technical representation compared GEANT CoCo REFEDS R&S Entity Category attribute Yes Md:RequestedAttributes MUST, isRequired=”true” SHOULD Associated attribute list Not limited At least eduPersonPrincipalName, mail, displayName OR (givenName AND sn) Other metadata elements Mdui:DisplayName Mdui:Description Mdui:PrivacyStatementURL Mdui:InformationURL

R&S SPs Coco SPs Any conflicts? An SP can assert both R&S and CoCo at the same time An IdP can assert support to both R&S and CoCo at the same time The assertions are interpreted to be independent No boolean logic available for the support attribute E.g. cannot express ”As an IdP, I’m willing to release attributes to R&S SPs iff they are committed to the CoCo” R&S SPs Coco SPs