| TD: IDEF Data Minimization

IDEF Data Minimization, v1.0

Specifies requirements in accordance with Identity Ecosystem Framework (IDEF) requirement PRIVACY-1: DATA MINIMIZATION.

Assessment Steps (3)

1 Data Limited to Transaction Purpose and Related Legal Requirements (DataLimitedtoTransactionPurposeandRelatedLegalRequirements) Does the entity limit the collection, use, transmission and storage of personal information to the minimum necessary to fulfill that transaction's purpose and related legal requirements? Artifact A1 Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) and supporting notes as appropriate to support the assessor's response to this assessment step.
2 Claims and Attributes Data Limited to What Is Requested (ClaimsandAttributesDataLimitedtoWhatIsRequested) When providing claims or attributes, does the entity provide no more personal information than what is requested? Indicate "Not Applicable" (N/A) if the entity does not provide claims or attributes. Artifact A1 Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) and supporting notes as appropriate to support the assessor's response to this assessment step.
3 Technical Mechanisms for Information Requests of Variable Granularity (TechnicalMechanismsforInformationRequestsofVariableGranularity) When acting in the role of identity provider and where feasible, does the entity support data minimization by providing technical mechanisms to accommodate information requests of variable granularity? Indicate "Not Applicable" (N/A) if the entity is not an identity provider. Artifact A1 Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) and supporting notes as appropriate to support the assessor's response to this assessment step.

Conformance Criteria (1)

Data Minimization Entities MUST limit the collection, use, transmission and storage of personal information to the minimum necessary to fulfill that transaction's purpose and related legal requirements. Entities providing claims or attributes MUST NOT provide any more personal information than what is requested. Where feasible, identity providers MUST provide technical mechanisms to accommodate information requests of variable granularity, to support data minimization. Citation IDEF Page 9

Show Metadata, Sources & Terms

Hide Metadata, Sources & Terms

Metadata

Identifier

https://artifacts.trustmarkinitiative.org/lib/tds/idef-data-minimization/1.0/

Publication Date

2018-10-01

Issuing Organization

Trustmark Initiative (https://trustmarkinitiative.org/) View Contact

Trustmark Support

help@trustmarkinitiative.org

555-555-5555

No Mailing Address

Keywords

IDEF, Limitation, Minimization, Privacy, Purpose

Issuance Criteria

no(NONE)

Target Recipient

Entities that want to participate in the Identity Ecosystem and demonstrate satisfaction of baseline identity service requirements and best practices such as those defined by the Identity Ecosystem Framework (IDEF) 1.0.

Legal Notice

This artifact is published by the Georgia Tech Research Institute (GTRI) as part of the Trustmark Initiative. This artifact and the information contained herein is provided on an "AS IS" basis, and GTRI disclaims all warranties, express or implied, including but not limited to any warranty that the use of the information herein will not infringe any rights or any implied warranties or merchantability or fitness for a particular purpose. In addition, GTRI disclaims legal liability for any loss incurred as a result of the use or reliance on the document or the information contained herein.

Sources (1)

IDEF	Identity Ecosystem Steering Group. Identity Ecosystem Framework (IDEF) Baseline Functional Requirements v1.0 with Supplemental Guidance. Approved on 15 Oct 2015. https://www.idesg.org/portals/0/documents/core/IDEF-Baseline-Requirement-v1.0-with-Supplemental-Guidance_MOD.pdf.

Terms (4)

Term Name	Abbreviations	Definition
Entity		Any organization providing identity services.
Identity Ecosystem Framework	IDEF	The overarching set of policies, best practices and standards that serve as the policy foundation for the Identity Ecosystem.
Identity Ecosystem Steering Group	IDESG	A voluntary, public-private partnership dedicated to developing an Identity Ecosystem Framework (IDEF) and services to better online digital identity. The IDESG looks to advance the Identity Ecosystem called for in the National Strategy for Trusted Identities in Cyberspace (NSTIC).
Personal Information		Broadly means any information about or linked to a user that is collected, used, transmitted, or stored in or by digital identity management functions.

Also available as XML or JSON