Interfederation

[Steven Carmody <>]

Hi,

One of the problems that edugain has encountered over the last several 
years has been finding an approach whereby IDPs would be comfortable 
releasing attributes to SPs without worrying about exposure under the EU 
Privacy Directive. A refeds and Geant sponsored effort (The Data 
Protection Code of Conduct 
https://refeds.terena.org/index.php/Data_protection_coc ) has created a 
framework that provides both IDPs and SPs a common approach that allows 
both entities to be comfortable that they are operating in compliance 
with the EU Privacy Directive without having a bilateral contract in 
place. The CoC was piloted by several Federations with the CLARIN VO; 
the pilot produced several recommendations to simplify the CoC.

The current CoC, tho, only addresses releasing attributes between 
parties that are members of the EU/EEA, or are recognized as having 
privacy law that is comparable to the EU's (eg Canada). As we all know, 
the US isn't an EU member. The EU does recognize the US Commerce Depts 
"Safe Harbor" Program; unfortunately, that program explicitly excludes 
Higher Ed.

There is a refeds work effort this year to extend the CoC beyond the Eu. 
There has been some conversation with the Brussels-based lawyer who 
helped to develop the CoC, and he has made some recommendations on how 
to proceed with extending the CoC.

I think this group's report should make some mention of the attribute 
release issues. In addition, we might want to discuss forwarding 
Patrick's thoughts to the IC lawyers for review.

This hasn't been an issue in our pilots (LIGA and Cardiff), but is 
likely to be an issue as we scale up.