GÉANT Data Protection Code of Conduct
Explanatory memorandum
for the Article 29 Working Party

20th November, 2014

© GEANT Limited on behalf of the GN3plus project.
The research leading to these results has received funding from the European Community’s Seventh
Framework Programme (FP7 2007–2013) under Grant Agreement No. 605243 (GN3plus).

GÉANT Data Protection Code of Conduct
Explanatory memorandum

2

Contents
Summary ............................................................................................................................. 4
1. Context ............................................................................................................................ 6
1.1. Who we are .............................................................................................................. 6
1.2. Access to research infrastructures .......................................................................... 6
1.3. Federated Identity Management............................................................................. 8
1.4. The relationship triangle .......................................................................................... 9
1.5. Academic Identity Federations .............................................................................. 10
1.6. eduGAIN interfederation service ........................................................................... 11
2. Data protection directive requirements ....................................................................... 122.1. Personal data (Article 2.a)...................................................................................... 122.2. Data controller/data processor (Article 2.d,e) ...................................................... 122.3. Purpose of processing (Article 6.b) ........................................................................ 122.4. Informing the End User (Article 11) ....................................................................... 122.5. Relevance of Attributes (Article 6.c) ...................................................................... 13
2.6. Keeping Attributes up-to-date (Article 6.d) ........................................................... 13
2.7. Legal grounds (Article 7) ........................................................................................ 14
Controller legitimate interests .................................................................................. 14
Data subject consent ................................................................................................ 15
2.8. Security of processing (Article 17) ......................................................................... 15
3. Requirements from the research and education sector .............................................. 16
3.1. Scalability ............................................................................................................... 16
3.2. Balance risk with the ease of collaboration ........................................................... 16
3.3. Sustain and recover from incidents and misbehaving entities ............................. 16
3.4. Minimise the risk of a Home Organisation’s liability for a Service Provider’smisbehaviour and vice versa ........................................................................................ 16
3.5. Suggest good practices to the Home Organisations .............................................. 17
3.6. Minimise the Federation Operator’s role .............................................................. 17
3.7. The importance of a global approach .................................................................... 18

GÉANT Data Protection Code of Conduct
Explanatory memorandum

3

4. GÉANT Data Protection Code of Conduct ..................................................................... 18
4.1. Goal and approach ................................................................................................. 18
4.2. Supporting documents........................................................................................... 19
4.3. Supplementary tools .............................................................................................. 20
5. Geographical/jurisdiction considerations ..................................................................... 21
5.1. Attribute release to EU/EEA or country with adequate protection ...................... 21
5.2. Attribute release to a third country ....................................................................... 22
Appendix A: GÉANT Data Protection Code of Conduct
Appendix B: GÉANT Data Protection Code of Conduct (French translation)

GÉANT Data Protection Code of Conduct
Explanatory memorandum

4

Summary
Modern research is highly cross-national and collaborative. Researchers in thousands ofresearch organisations access services in other organisations using electronic means.
GÉANT develops and operates a pan-European e-infrastructure for authentication,authorisation and single sign-on for researchers (or "End Users") in research andeducation organisations in Europe.
The e-infrastructure provides researchers with easy access to cross-national research
infrastructures without the use of extra credentials, such as usernames and passwords.
Accessing the research e-infrastructure requires sharing some of a researcher’s personal
data from his/her research or education organisation (or "Home Organisation") to theservice provider he/she is accessing in another member state or beyond (or "Service
Provider").
For Home Organisations to share End Users’ personal data with Service Providers, theymust comply with relevant data protection legislation. However, the lack of scalable,
practical compliance guidelines has caused e-infrastructures in different member states
to adopt fragmented practices for personal data release, which is hindering crossnational access to services.
Discomfort about data protection compliance has also led to an approach where, to be
cautious, Home Organisations do not share End Users’ personal data with the Service
Provider. As a consequence, End Users need to register and create separate credentials
for each service, undermining the reliability of the credentials, inhibiting access toservices, causing administration overheads and resulting in less efficient pan-European
academic research.
GÉANT, as a cross-border European academic research and education e-infrastructure,drafted a pan-European Code of Conduct to facilitate the application of the dataprotection principles stemming from the Data Protection Directive, taking account the
specific characteristics of the processing carried out in the academic sector, andrespecting the national provisions adopted by member states.
The attached GÉANT Data Protection Code of Conduct proposes a scalable approach toprotect the End User’s personal data when he/she logs in to a service provided byanother organisation. The Code of Conduct presents a harmonized approach to which
Service Providers can commit when receiving End Users’ personal data from the Home
Organisations. Home Organisations will feel more comfortable to release affiliated End-GÉANT Data Protection Code of Conduct
Explanatory memorandum
User personal data to the Service Provider if they can see that the Service Provider hastaken measures to properly protect the data.
A formal endorsement of the pan-European Code of Conduct by the Article 29 Working
Party would enhance the credibility of the Code of Conduct.

5

GÉANT Data Protection Code of Conduct
Explanatory memorandum

6

1. Context
1.1. Who we are
GÉANT1 is the pan-European research and education backbone network thatinterconnects Europe’s National Research and Education Networks (NRENs). Together
with its national partners (the NRENs), the GÉANT network offers network connectivity
and associated services (such as, an e-infrastructure for electronic identity) to over
10 000 research and education institutions in 42 countries, including all EU member
states.
The GÉANT network is developed and operated by the GÉANT project (GN3plus), which
receives funding from the Seventh Framework Programme of the European
Commission. The project is coordinated and the network is operated by GEANT Limited(formerly Delivery of Advanced Network Technology to Europe (DANTE)2), a limited
liability company and a not-for-profit organisation that is part of the GÉANT
Association3, the leading collaboration on network and related infrastructure andservices for the benefit of research and education.
As the coordinator of the GÉANT project, GEANT Limited has submitted this Code of
Conduct to the Article 29 Working Party, on behalf of the GÉANT project partners.

1.2. Access to research infrastructures
The success of the European economy is increasingly dependent on scientific andtechnological innovation. The European Research Area (ERA) was launched at the Lisbon
European Council in March 2000. The development of ERA is needed to overcome thefragmentation of research in Europe along national and institutional barriers.
According to the EC’s vision of the ERA, major infrastructures should be built andexploited in the form of joint European ventures. They should be accessible toresearch teams from across Europe and the world, with researchers working inEurope having access to international infrastructures and equipment in other parts of
the world. These research infrastructures should be integrated, networked and accessed1

http://www.geant.net/

2

http://www.dante.net/

3

http://www.geant.org/

GÉANT Data Protection Code of Conduct
Explanatory memorandum

7

through the concomitant development of new generations of electronic communication
infrastructures (also known as “e-infrastructures”), both in Europe and globally.4
In the strategy report on the European Research Infrastructure roadmap,5 ESFRI
identified 44 research infrastructure projects from the broad disciplines of social
sciences and humanities, environmental science, energy, biological and medical
sciences, materials and analytics facilities, and physical sciences and engineering. The
construction costs of the individual projects are between EUR2 M and EUR2100 M, andannual operation costs range from EUR2 M to EUR120 M. In 2010, ten projects hadentered the implementation phase. Many of the research infrastructures rely on theavailability of secure and reliable e-infrastructures.
For security reasons, researchers usually need electronic identities for authenticationand verification of access rights before they can access the research infrastructure. In its
communication on the ERA6 in 2012, the European Commission invites the member
states to adopt and implement national strategies for electronic identity for researchers
giving them transnational access to digital research services and research stakeholder
organisations, to implement and promote the uptake of electronic identity and digital
research services. The ERA communication also reflects the 2010 Digital Agenda for
Europe, whose Key Action 3 calls for a framework for cross-border recognition andinteroperability of secure eAuthentication systems.7
Without a proper e-infrastructure for electronic identities, the ERA researchers need to
manage credentials for thousands of services, inhibiting effective co-operation andresearch and creating administrative burdens. To provide an e-infrastructure for secureauthentication, authorisation and single sign-on of researchers and other End Users, a
new approach, Federated Identity Management, has been introduced, which is
described in the next section.

4

European Commission. The European Research Area: New perspectives. Green Paper 4.4.2007.

5

European Strategy Forum on Research Infrastructures. Strategy Report on Research Infrastructures.
Roadmap 2010.
6

European Commission. A Reinforced European Research Area Partnership for Excellence and Growth.
COM(2012) 392, 17.7.2012.
7

European Commission. A Digital Agenda for Europe. COM(2010) 245, 26.8.2010.

GÉANT Data Protection Code of Conduct
Explanatory memorandum

8

1.3. Federated Identity Management
Federated Identity Management is crucial to the ability of e-Infrastructures to operate ina scalable, secure manner. In order to operate, however, Federated Identity
Management requires a trust framework to exchange some of the researcher’s personaldata.

End User
Authentication
IdP
Home
Organisation

Service
Attribute release

Authorisation

SP
Service Provider
Organisation

Figure 1. The basic actors in Federated Identity Management and their division of responsibility.

The basic division of responsibility is presented in Figure 1. End Users are researchers,
teachers, students and other natural persons affiliated to a university, research
institution or other Home Organisation. Home Organisations (such as universities andresearch institutions) are responsible for managing their End Users’ personal data
(called Attributes, such as name, e-mail address and role/position in the Home
Organisation) and for delivering credentials (such as usernames and passwords) to allow
identified access to local and federated services. At the moment when an End User
accesses a Service Provider, his/her Home Organisation authenticates him/her using
such credentials. The authentication is performed by an Identity Provider server (IdP)
that the Home Organisation operates.8 After authenticating the End User, the Identity
Provider delivers the End User’s Attributes to the Service Provider server (SP) the End
User is accessing. The Attribute delivery takes place at the time when the End User
accesses the service. Based on the Attributes, the Service Provider decides if the End
User is entitled (authorised) to use the Service, and assigns him/her to his/her existing
profile in the Service, if any.

8

The Identity Provider server can be operated by the Home Organisation or the Home Organisation canoutsource it. In some countries, the federation operator operates a centralized Identity Provider for theHome Organisations.

GÉANT Data Protection Code of Conduct
Explanatory memorandum

9

By virtue of the Federated Identity Management, the End User only needs a single set of
credentials to access all Service Providers, and can enjoy a single sign-on experience.
Service Providers do not need to maintain End Users’ credentials, and are able toreceive End Users’ up-to-date and reliable attributes from their Home Organisations.
When an End User departs, the Home Organisation closes his/her account, and accessto the research infrastructures ceases.

1.4. The relationship triangle
From a data protection perspective, there are three parties and three relationships
involved (see Figure 2).
End User(data subject)

Service-related
Privacy Policy

Acceptable Usage
Policy and Privacy
PolicyHome
Organisation(controller)

Code of Conduct

Service Provider(controller)

Figure 2. The triangle of relationships involved in Federated Identity Management.

The Home Organisation processes the End User’s personal data to carry out its duties as
an employer, to provide teaching to a student, or to fulfil other tasks of the institution.
The relationship between the End User and the Home Organisation is governed by an
Acceptable Usage Policy (typically including or linked to a privacy policy), to which the
End User commits at the start of his/her employment, studies, or other relationship in
his/her Home Organisation, and receives his/her username and password from theHome Organisation.
The Home Organisation delivers the End User’s Attributes to the Service Provider toenable the researcher or student to conduct research, take courses, etc. The
relationship between the End User and the Service Provider is set by the Service
Provider’s purpose of data processing and is documented in the Service Provider’sservice-related Privacy Policy.
In some circumstances, the Home Organisation and Service Provider may have abilateral agreement that also addresses protection in the End User’s personal data.

GÉANT Data Protection Code of Conduct
Explanatory memorandum

10

However, to guarantee a baseline for data protection in the instances where there is nobilateral agreement, the Code of Conduct helps the Service Provider to engage with theHome Organisations on data protection practices.

1.5. Academic Identity Federations
The federated approach to identity management presented above suffers fromscalability problems when End Users from thousands of Home Organisations need toaccess thousands of Service Providers. To address this issue with scalability, einfrastructures called Identity Federations have been established in the research andhigher education sector since 2005.
Today, academic Identity Federations are nationally focused and typically organised by
NRENs, the non-profit organisations providing Internet connectivity and associatedservices to researchers, teachers and students in the institutions. Currently, there are 23
academic Identity Federations9 in EU member states. In November 2014, thosefederations had a total of 2738 IdP and 3395 SP servers registered.10
The role of the Identity Federation (Figure 3) is to set the rules for its Members (i.e.
Home Organisations and Service Provider Organisations), such as the eligibility to join
the federation, minimum requirements for strength of End User authentication, liability,
technical specifications, etc. The Identity Federation also nominates an organisation to
be responsible for operations of the federation. The Federation Operator (typically, theNREN) takes care of day-to-day issues, such as registering Members’ Identity and Service
Provider services to the federation, providing technical support to the Members, etc.
IdP
IdP
Home Organisation IdP

SP

SP
SP

Identity
Federation

SP

Service Provider Organisation

SP

Figure 3. An Identity Federation is an e-infrastructure service that allows Identity Provider (IdP) servers (managed by
End Users’ Home Organisations) and Service Provider (SP) servers (managed by SP organisations) to exchange
Attributes on authenticated End Users.

9

TERENA Compendium of National Research and Education Networks in Europe, 2014 edition
https://compendium.terena.org/reports
10

https://met.refeds.org/met

GÉANT Data Protection Code of Conduct
Explanatory memorandum

11

Typical services to which academic Identity Federations provide authentication andauthorisation are scientific journals and other licensed content (such as university
libraries’ electronic magazine subscriptions for researchers), e-learning (teachers’ virtual
learning tools to support their teaching), collaboration (wikis and fileshares for crossorganisation workgroups) and SaaS services (universities’ outsourcing ofadministrational services to the private sector). Recently, however, Identity Federations
have started to face increasing demand to support multinational research
infrastructures. This has created the need to bridge the formerly national federations
into a cross-national interfederation service called eduGAIN.

1.6. eduGAIN interfederation service
The eduGAIN service11 (delivered by the EC-funded GÉANT GN3plus project) connects
the national academic federations into an interfederation service (see Figure 4). Within
their Home Organisation, End Users can use their local usernames and passwords toaccess Service Providers in another Participant Federation (countries).
SP

IdP
IdP
IdP

SP

SP

IdP

SP

SP
SP

ParticipantFederation

ParticipantFederation
eduGAIN
service

IdP

ParticipantFederation

IdP
IdP

SP

SP

SP

SP
SP

ParticipantFederation
SP

SP

SP
SP

SP

Figure 4. eduGAIN interfederation service connects its participants and allows a direct exchange of Attributes between
Identity Providers (IdP) and Service Providers (SP).

The technical architecture is distributed as shown in Figure 4. eduGAIN mediates IdPs’
and SPs’ technical descriptions (such as the address of the server endpoints and theirtrusted certificates) between the Participant Federations. There is no single proxy serverthat channels the entire message exchange in eduGAIN. Any release of personal datatakes place directly between the IdP and SP.

11

http://www.edugain.org/

GÉANT Data Protection Code of Conduct
Explanatory memorandum

12

The eduGAIN interfederation service establishes a pan-European e-infrastructure forelectronic identity in the ERA. It eases co-operation of researchers and other End Users
throughout Europe and reduces the administrative burden needed to access research
infrastructures. eduGAIN also supports the European single market introduced in Article
3 of the Treaty on European Union, and is interconnected with similar e-infrastructuresin other parts of the world.

2. Data protection directive requirements
This section summarises the interpretation of service-specific requirements that
eduGAIN derives from Directive 95/46/EC.

2.1. Personal data (Article 2.a)
Typical Attributes released to the Service Provider by a Home Organisation include: theEnd User’s online identifier (if possible, pseudonomised), name and email address. It is
often necessary to also release Attributes describing the End User’s relationship to theHome Organisation, such as the name of the Home Organisation and the organisational
unit the End User is affiliated to, and his/her role in the Home Organisation (e.g.
student, researcher, member, library walk-in, etc). In some cases, there is a requirement
to exchange more sophisticated Attributes, e.g. those based on a person’s entitlement
to use a specific resource. Such Attributes, alone or together, qualify as personal data.

2.2. Data controller/data processor (Article 2.d,e)At least the Home Organisations and Service Providers, but also possibly the federations
and eduGAIN, qualify as data controllers. It is possible that the Home Organisation andService Provider are considered joint data controllers.

2.3. Purpose of processing (Article 6.b)In the context of Federated Identity Management, the purpose of processing personal
data is to share necessary (but not excessive) personal data on the End User from
his/her Home Organisation to the Service Provider, in order for the Service Provider tobe able to provide access to the service for eligible End Users.

2.4. Informing the End User (Article 11)
According to the Code of Conduct, Service Providers are obliged to publish a prominent
link to the service’s privacy policy in the service’s landing page. End Users have an
opportunity to study the privacy policy before they log in and their Attributes are
released from the Home Organisation to the Service.

GÉANT Data Protection Code of Conduct
Explanatory memorandum

13

Figure 5. Example of how a Home Organisation should inform End Users and provide an opt-out opportunity before
Attributes are released to a new Service Provider. Clicking the Service Provider Name leads to its Privacy policy page.

Additionally (see Figure 5), it is recommended that the Home Organisations ensure that
their duty to inform the End User is fulfilled by providing End Users with the service’s
name, description, clickable privacy policy link and requested Attribute names andvalues before the Attribute release takes place for the first time.

2.5. Relevance of Attributes (Article 6.c)
The Service Provider has service expertise as well as understanding of the Attributerequirements of the service. For reasons of scalability, the Code of Conduct proposes anapproach where the Service Provider publishes a list of its Attribute requirements andtakes full responsibility to ensure Attributes are adequate, relevant and not excessive, in
relation to the purpose of processing. Alternatively, the Service Provider can assign theservice to a category of similar services, such as, “Research and Scholarship”, with anassociated list of Attributes typical for those services. Home Organisations are expected
to respect that list.

2.6. Keeping Attributes up-to-date (Article 6.d)
It is assumed that the Home Organisation, which has a close relationship to the End
User, is well placed to ensure that End Users’ Attributes are kept up-to-date. Therefore,
the Attributes are periodically refreshed from the Home Organisation to the Service
Provider, commonly every time the End User logs in to the service. The End User should
contact his/her Home Organisation to rectify these Attributes, if necessary.
However, many Service Providers also want to maintain some additional personal datain the service (for example, the End User’s preferences in that particular service). The
Service Provider’s Privacy policy instructs the End User how to rectify this data.

GÉANT Data Protection Code of Conduct
Explanatory memorandum

14

2.7. Legal grounds (Article 7)
Controller legitimate interests
Reliance on the notion of legitimate interests legal grounds (Article 7.(f)) is generally
justified for both Home Organisations and Service Providers.
Taking into account the WP 29 Opinion 06/2014 on the notion of legitimate interests ofthe data controller, we note the following:
Home Organisations and Service Providers both have an interest in ensuring the services
offered by Service Providers are available and accessible to all End Users in a way that
limits the administrative burden for End Users. Indeed, Home Organisations and Service
Providers have an interest in avoiding a situation where the procedure to gain access tothe services becomes an impediment to the actual use of the service.
We note that this interest (i) is lawful and not contrary to applicable EU and national
laws; (ii) is clearly articulated; and (iii) represents a real and present interest for theHome Organisations and Service Providers; and as such, constitutes a "legitimate
interest" in the sense of article 7.f of the Directive.
Furthermore, we note that the Attribute-release mechanism, as described above, isindeed necessary to achieve the interest pursued. There are no reasonably workable,
less-invasive means to reach the identified purpose of the processing.
In general, it is believed that there are no overriding fundamental interests or rights of
End Users that would prevent reliance on the legitimate interests legal ground, because
a.o.







The interest of the controllers, providing the End User with the service he/she hasrequested in an easily accessible manner, coincides with a wider, public interest, i.e.
fostering scientific and technological innovation.
Without the processing taking place, Service Providers would not be able to provide
access to the service for eligible End Users.
While it is assumed that all Attributes qualify as personal data, we consider theactual information being exchanged (name, role, email address) and the types ofservices and content accessed by the end uses (mainly scientific) to be innocuous, inparticular, when Attributes would be (partially) pseudonomised.
The impact on End Users is very limited, compared to the benefit the system brings
to End Users as well as Home Organisations and Service Providers.

GÉANT Data Protection Code of Conduct
Explanatory memorandum




15

Furthermore, additional safeguards will be implemented, including the following: A
design goal of Federated Identity Management and the Code of Conduct is toprotect the privacy of End Users and to minimise the amount of data being
exchanged. Instead of having End Users directly provide credentials to Service
Providers, the Home Organisations will channel the data exchange through Identity
Provider servers.
The Code of Conduct fully supports the aim of privacy protection and data
minimisation. For example, Service Providers must explicitly indicate which End User
Attributes are required through the technical infrastructure, and will not receive any
additional information. Furthermore, pseudonymisation will be used, when possible.

Data subject consent
In addition to the release of necessary attributes based on the legitimate interests
grounds, in future, there are plans to extend the Code of Conduct, to provide an End
User with an opportunity to provide informed consent (Article 7.(a)) to the release ofnecessary Attributes for additional purposes, and to the release of extra Attributes inexchange for added value services. For instance, if the End User wants to subscribe to aregular newsletter on service updates, he/she can consent to the Home Organisation’s
release of his/her e-mail address to the Service Provider.

2.8. Security of processing (Article 17)
The technical specifications used in federations12 recommend that message or transportlayer encryption is used to ensure the confidentiality of the Attributes when transmitted
over the network to the Service Provider. The integrity of the Attributes is guaranteedby mandatory digital signatures created by the Identity Provider server. Confidentiality
and integrity is supplemented by registering the Identity and Service Provider servers’
trusted certificates. Additionally, the Service Providers are expected to ensure thesecurity of their software installations and configurations.
The distributed architecture of eduGAIN has no central points that would be able toexamine the Attribute exchange between the Identity and Service Provider.

12

Currently, most federations make use of the SAML 2.0 standard (Security Assertion Mark-up Language)
and the SAML2int profile derived from it.

GÉANT Data Protection Code of Conduct
Explanatory memorandum

16

3. Requirements from the research and education sector
This section presents the requirements for the GÉANT Data Protection Code of Conductfrom the Research and Education (R&E) sector in Europe and beyond.

3.1. Scalability
The Code of Conduct should scale to the size where hundreds or thousands of Service
Providers and Home Organisations exchange End User Attributes. Bilateral negotiations
and/or contracts between each Home Organisation and Service Provider will notadequately fulfil this requirement.

3.2. Balance risk with the ease of collaboration
The Code of Conduct should find an appropriate balance between minimising the dataprotection risks and enabling easy collaborations for End Users in different Home
Organisations.
However, the Code of Conduct does not preclude a Home Organisation enteringbilateral negotiations with a Service Provider in the case where the safeguards offeredby the Code of Conduct are not sufficient e.g. for particularly sensitive work.

3.3. Sustain and recover from incidents and misbehaving entities
In an ideal world, all parties would meet their respective data-protection-related
requirements, and all parties would be able to assume that all other parties will also
meet their data-protection-related responsibilities. There would be no security
incidents; no End Users would think that their privacy has been breached. In practice,
however, that world does not exist. It is necessary to develop a design that provides all
parties with sufficient assurance that other parties with which they interoperate areaware of and meet their data-protection-related responsibilities, and that all parties areable to tolerate and recover from incidents and misbehaving entities.

3.4. Minimise the risk of a Home Organisation’s liability for a Service
Provider’s misbehaviour and vice versa
In general, it is the role of a Home Organisation to release Attributes to a Service
Provider when the Attribute release supports its End User’s research, teaching andstudy-related activities. However, if it turns out that the Home Organisation may
become liable for a data protection problem caused by a Service Provider, the Home
Organisations may become hesitant and refrain from their role as an Identity Provider(and vice versa). Instead, the End Users would need to self-register and learn local

GÉANT Data Protection Code of Conduct
Explanatory memorandum

17

usernames and passwords, which would defeat the benefits of Federated Identity
Management.
Thus, it is important that the Code of Conduct clearly allocates responsibility forcompliance with data protection rules and responsibility for possible breach of theserules to Home Organisations and Service Providers. It must be avoided that there is (a) aloophole where not all obligations imposed by the Directive are covered by a party; or(b) a situation where a party can be held liable for another party's misbehaviour.
The Code of Conduct must therefore provide a clear and effective allocation of
obligations and responsibilities between all parties.

3.5. Suggest good practices to the Home Organisations
The intention of the Code of Conduct is to reduce Home Organisations’ hesitation torelease Attributes to the Service Providers by providing a tool to support risk analysis.
This is achieved by clearly documenting behavioural rules for Service Providers. The
rules enable the Home Organisation to decide whether it is safe to release personal data
to the Service Provider. It should be noted that this only applies to the Home
Organisation’s release of data to the Service Provider. The Code of Conduct is a Code of
Conduct for Service Providers, not for Home Organisations. The Code of Conduct may
introduce good practices that can help a Home Organisation to reduce its dataprotection-related risks, but if the Home Organisation decides to ignore them, it is firstand foremost the Home Organisation, not the Service Provider, that is exposed to risk.

3.6. Minimise the Federation Operator’s role
The Attribute exchange takes place between the Home Organisation and the Service
Provider. In most academic Identity Federations, the Federation Operator is not
involved in the transaction.13 The Code of Conduct therefore does not cover thefederation operator's liability for data protection issues caused by the Home
Organisation or the Service Provider.

13

In some countries, the Federation Operator operates a centralised Identity Provider on behalf of theHome Organisations. In those countries, the Federation Operator is involved in the transaction as a dataprocessor.

GÉANT Data Protection Code of Conduct
Explanatory memorandum

18

3.7. The importance of a global approach
The R&E community is global, and research collaborations cross national and federation
borders. The approach adopted should be applicable globally, or at least as widely as
possible.

4. GÉANT Data Protection Code of Conduct
This section presents how the approach presented in the previous section is put into
practice in the GÉANT Data Protection Code of Conduct, and describes the framework
developed to supplement its use. The proposed Code of Conduct may be found in
Appendix A.

4.1. Goal and approach
The EU member states’ 20 academic Identity Federations have been developed
independently, with fragmented approaches to data protection issues often primarily
embedded in specific national laws. A goal of the Code of Conduct is to
(i)

(ii)

Seek for a pan-European interpretation and good practice approach for theissues related to data protection in Federated Identity Management inresearch and education, andPromote pan-European interpretation and practice to eduGAIN ParticipantFederations, in order to reduce obstacles hindering cross-national access toresearch infrastructures.

These requirements do not seek to replace or reduce requirements of specific dataprotection regulation for e-Infrastructures and parties involved in federated identity.
Rather, the aim of the Code of Conduct is to identify and highlight key aspects for the
R&E community in a scalable way.
The Code of Conduct covers issues related to the protection of the End User’s personal
data received from his/her Home Organisation when he/she accesses the service. The
Code of Conduct does not cover data protection issues related to the content of theservice, such as, how biological research data can be shared for research purposes if it
contains potentially sensitive patient data.

GÉANT Data Protection Code of Conduct
Explanatory memorandum

HO
HO

Learn SPs’commitment

HO

Data
Protection
Code of
Conduct

Home
Organisations

19

SP
Commit toSP
SPService
Providers

Figure 6. Service Providers (SP) commit to the Data protection Code of Conduct. Home Organisations (HO) learn theService Providers’ commitment by the indications relayed by the Identity Federation(s).

The intention (depicted in Figure 6) is that the Service Provider commits to the Code of
Conduct, the Identity Federations (and the eduGAIN interfederation service) relay anindication of the commitment to the Home Organisations, who then make the decision
about releasing Attributes to the Service Providers.
A pilot on the Code of Conduct has been started within the eduGAIN community. In
November 2014, 37 Service Providers have expressed their commitment to the Code of
Conduct, most of them in the disciplines of linguistics, the arts and humanities.
Although designed for the eduGAIN interfederation service, it is intended that the Codeof Conduct can also be used locally within the national Identity Federations.

4.2. Supporting documents
The eduGAIN project has developed extensive additional material14 to support Service
Providers, Home Organisations and Identity Federations in adopting the Code of
Conduct.
The normative documents consist of the Code of Conduct (Appendix A) and technicalspecifications on how to use the SAML 2.0 standard to convey information on Service
Providers’ commitment to the Code of Conduct to the Home Organisations in the mostreliable way. The technical specifications also describe how the Service Provider serverpresents to the Identity Provider server the link to its privacy policy page and the list of
Attributes it requests from the Home Organisation. This information is sufficient for theHome Organisation to configure its Identity Provider server to inform the End User of

14

https://wiki.refeds.org/display/CODEGÉANT Data Protection Code of Conduct
Explanatory memorandum

20

the Attribute release, and to release a limited Attribute set to Service Providers without
administrational involvement, for each Service Provider.
In addition to the Code of Conduct, the normative documents are complemented withguidelines and good practice:














How to develop a privacy policy document. Although obliged by the directive andnational laws, practice has shown that many Service Providers have problems indeveloping an appropriate privacy policy document for their service. A practical
template is provided to assist the Service Providers.
How to assess what Attributes are relevant for a Service Provider. This guideline
assists Service Providers’ decision-making process regarding what Attributes they
can reasonably request from the Home Organisations under the Code of Conduct.
Good practices for a Home Organisation to release Attributes. Good practice, forinstance, suggests that a Home Organisation informs the End User before the
Attribute release (see Figure 5 on page 13) and proposes that a Home Organisation
develops a maximum list of Attributes to release under the Code of Conduct, basedon risk assessment.
Guidelines for Identity Federations. The guideline describes how the Identity
Federations are expected to record a Service Provider’s commitment to the Code of
Conduct and to convey it to the Home Organisations.
How to handle Service Provider’s non-compliance to the Code of Conduct. This
guideline suggests enforcement actions if someone (such as, an End User, Home
Organisation or Federation operator) believes a Service Provider is not complying
with the Code of Conduct, even though it has committed to it.
How the Home Organisation should inform the End User on the Attribute release.
This guideline is primarily for software developers who develop an End Userinterface for the Attribute release on an Identity Provider server (see Figure 5 onpage 13).
A Code of Conduct cookbook with recipes for Service Providers, Home Organisations
and federation operators. The recipes provide step-by-step guidance on how to
deploy the Code of Conduct.

4.3. Supplementary tools
As the operator of the eduGAIN interfederation service, the GÉANT project runs amonitoring service15 of all Service Providers that have expressed commitment to the15

http://monitor.edugain.org/coco

GÉANT Data Protection Code of Conduct
Explanatory memorandum

21

Code of Conduct. The monitoring tool performs some technical basic checks to theService Providers to make sure they have published a privacy policy document and thelist of necessary Attributes that Home Organisations need to release. The tool provides apage where Service Provider administrators can check their technical conformance (seeFigure 7).

Figure 7. A Code of Conduct monitoring tool helps Service Provider administrators to ensure their technicalconformance. Green line indicates the SP is OK, red indicates a problem. White SPs have not committed to the Code of
Conduct.

The monitoring tool also periodically archives the monitoring results and the Service
Providers’ Privacy policy documents for audit trail, in case of a later dispute.

5. Geographical/jurisdiction considerations
Initially, eduGAIN only provided interfederation services to federations in Europe.
However, as mentioned in Section 1 and 3.7, research is global, and there is a need to
exchange Attributes with data controllers outside the EU/EEA.

5.1. Attribute release to EU/EEA or country with adequate protection
According to the basic scenario, both the Service Provider and Home Organisation are
established in an EU/EEA country or in a country or arrangement that ensures adequate
protection, as defined in Article 25 of the Directive. In this case, the Code of Conduct is abinding document which:

GÉANT Data Protection Code of Conduct
Explanatory memorandum




22

indicates the Service Provider is aware of its legal obligation to protect personal
data,
limits the data protection risks of the Home Organisation that releases Attributes to
the Service Provider, anddivides responsibility between the Home Organisation and the Service Provider in ascalable manner.

The Code of Conduct can be seen as a unilaterally binding declaration the Service
Provider makes as part of its data protection practices towards all Home Organisations
whose End Users are welcome to use the service.

5.2. Attribute release to a third country
If the Service Provider resides in a country which does not ensure adequate protection(“third country”), the Code of Conduct should be used together with the Standard
Contractual Clauses.16 In that scenario, the Service Provider (outside EU/EEA) and theHome Organisation (in EU/EEA) commit, respectively as a data importer and as a data
exporter, to the Code of Conduct combined with the Standard Contractual Clauses(Figure 8).

HOHOCommit toHO
Home
Organisations
in EU/EEA

Data Protection
Code of Conduct&
Standard
Contractual
ClausesSP
Commit toSP
SPService
Providersoutside EU/EEA

Figure 8. Code of Conduct in combination with Standard Contractual Clauses to enable Attribute release to third
countries.

The proposed approach would form a multilateral agreement, where several Home
Organisations and several Service Providers are committed to the same contractual
terms. Via the multilateral agreement, each Home Organisation and Service Provider
16

Standard contractual clauses for the transfer of personal data from the Community to third countries(controller to controller transfers)

GÉANT Data Protection Code of Conduct
Explanatory memorandum
has a direct contractual relationship with each other. However, each Service Provider
and Home Organisation needs to commit to the charter only once, fulfilling thescalability requirement presented in Section 3.1.

23

1
2

3
4

GÉANT Data Protection Code of
Conduct
For Service Providers established in European Union, European Economic Area andcountries with adequate data protection pursuant to Article 25.6 of the directive 95/46/EC

5

GN3-12-215

6
7Document URI:
http://www.geant.net/uri/dataprotection-code-of-conduct/v1

8

Version 1.0, 14 June 2013

9

Purpose and Context

10
11
12
13
14

Without prejudice to the provisions as set forth in the agreement between the Home Organisation and Service
Provider which in all cases takes precedence, this Code of Conduct sets the rules that Service Providers
adhere to when they want to receive End Users' Attributes from Home Organisations or their Agent forproviding access to their services. This Code of Conduct is a binding community code for the Service Providers
that have committed to it.

15
16
17
18

The work leading to these results has received funding from the European Community’s Seventh Framework
Programme (FP7 2007-2013) under Grant Agreement No. 238875 (GÉANT). This work is © 2012 Dante, used
under a Creative Commons Attribution ShareAlike license (CC BY-SA 3.0).

19

1/4

20

Definitions

1

21
22

a) Identity Provider (IdP): The system component that issues Attribute assertions on behalf of End Users
who use them to access the services of Service Providers.

2324b) Service Provider (SP): An organisation that is responsible for offering the End User the service he or
she desires to use.

25
26
27

c) Home Organisation: The organisation with which an End User is affiliated, operating the Identity
Provider by itself or through an Agent. It is responsible for managing End Users’ identity data andauthenticating them.

2829d) Agent: The organisation operating the Identity Provider on behalf of the Home Organisation, if
applicable.

3031e) Attributes: The End User's personal data as managed by the Home Organisation or its Agent, such as(but not limited to) name, e-mail and role in the Home Organisation.

32
33

f)

34
35

g) Personal Data: any information relating to an identified or identifiable natural or legal person, if
applicable.

End User: any natural person affiliated with a Home Organisation, e.g. as a researcher or student,
making use of the service of a Service Provider.

Principles of Attributes Processing

36

2

37

The Service Provider agrees and warrants:

3839a) [Legal compliance] to only process the Attributes in accordance with the relevant provisions of the
Personal Data protection law applicable to the Service Provider;

4041b) [Purpose limitation] to only process Attributes of the End User that are necessary for enabling accessto the service provided by the Service Provider;

2/4

42
43
44

c) [Data minimisation] to minimise the Attributes requested from a Home Organisation to those that are
adequate, relevant and not excessive for enabling access to the service and, where a number ofAttributes could be used to provide access to the service, to use the least intrusive Attributes possible;

45
46
47

d) [Deviating purposes] not to process the Attributes for any other purpose (e.g. selling the Attributes orselling the personalisation such as search history, commercial communications, profiling) than enabling
access, unless prior consent has been given to the Service Provider by the End User;48
49e) [Data retention] to delete or anonymise all Attributes as soon as they are no longer necessary for the
purposes of providing the service;50f)[Third parties] not to transfer Attributes to any third party (such as a collaboration partner) except

51

a. if mandated by the Service Provider for enabling access to its service on its behalf, or52
53

b. if the third party is committed to the Code of Conduct or has undertaken similar duties
considered sufficient under the data protection law applicable to the Service Provider or54c.

if prior consent has been given by the End User;

55
56
57
58
59

g) [Security measures] to take appropriate technical and organisational measures to safeguard
Attributes against accidental or unlawful destruction or accidental loss, alteration, unauthorized
disclosure or access. These measures shall ensure a level of security appropriate to the risks
represented by the processing and the nature of the data to be protected, having regard to the state of
the art and the cost of their implementation.

6061h) [Information duty towards End User] to provide to the End User, at least at first contact, in an easily,
directly and permanently accessible way a Privacy Policy, containing at least the following information:

62a. the name, address and jurisdiction of the Service Provider;63b. the purpose or purposes of the processing of the Attributes;

64

c.

65
66
67

d. the third party recipients or categories of third party recipient to whom the Attributes might bedisclosed, and proposed transfers of Attributes to countries outside of the European Economic
Area;

68

e. the existence of the rights to access, rectify and delete the Attributes held about the End User;

69

f.

70

g. a reference to this Code of Conduct;

71
72

i)

a description of the Attributes being processed;

the retention period of the Attributes;[Information duty towards Home Organisation] to provide to the Home Organisation or its Agent atleast the following information:

3/4

73

a. a machine-readable link to the Privacy Policy;

74

b. indication of commitment to this Code of Conduct;

75
76

c.

any updates or changes in the local data protection legislation, which are less strict than theprinciples set out in this Code of Conduct;

77
78
79

j)

[Security Breaches] to, without undue delay, report all suspected privacy or security breaches(including unauthorized disclosure or compromise, actual or possible loss of data, documents or any
device, etc.) concerning the Attributes to the Home Organisation or its Agent;

80
81
82

k)

[Liability] to hold harmless the End User, the Home Organisation as well as the Agent who has
suffered damage as a result of any violation of this Code of Conduct by the Service Provider as
determined in a binding and enforceable judicial ruling;

83
84
85
86
87

l)

[Transfer to third countries] when Attributes are being transferred outside the European Economic
Area and countries with adequate data protection pursuant to Article 25.6 of the directive 95/46/EC, toensure an adequate level of protection of the Personal Data by taking appropriate measures pursuant
to the law of the country in which the Home Organisation is established, such as requesting End User
consent or entering into agreements with the Home Organisation based on EU model clauses;

88
89
90
91
92

m) [Governing law and jurisdiction] to have this Code of Conduct governed by the national material lawof the country in which the Service Provider is established with the exclusion of its international private
law and to have any disputes regarding the validity, the interpretation or the implementation of thisCode of Conduct definitively decided by the competent court of the country in which the Service
Provider is established;

9394n) [Eligibility to execute] to have this Code of Conduct executed by a duly authorised representative of
the Service Provider;95o) [Termination of the Code of Conduct] to only terminate adherence to this Code of Conduct in case of96

a. it being replaced by a similar arrangement or

97

b. termination of the service provisioning to the Home Organisation;

9899p) [Survival of the clauses] to be bound by the provisions of this Code of Conduct that are intended tosurvive due to their sense and scope after the end, lapse or nullity of this Code of Conduct;

100
101
102
103

q) [Precedence] to comply with the stipulation that, in the event of conflict between a provision containedin this Code of Conduct and a provision of the agreement concluded between Service Provider andHome Organization, the provision of the agreement concluded between Service Provider and Home
Organization takes precedence over the provision of this Code of Conduct.

104

4/4

GEANT

GEANT - Code de Conduite concernant la protection desdonnées dePour les Fournisseurs de Services établis dans l'Union européenne, l'Espace Economiqueeuropéen et les pays assurant une protection des données adéquate conformément à l'article
25§6 de la Directive 95/46/CE
GN3-12-215
Document URI:
http://www.geant.net/uri/dataprotection-code-of-conduct/v1
Version 1.0, 14 juin 2013

Objectif et Contexte
Sans préjudice des dispositions reprises dans le contrat entre l'Organisme d'Origine et leFournisseur de Service qui primeront en toutes circonstances, ce Code de Conduite détermine
les règles auxquelles les Fournisseurs de Services adhèrent lorsqu'ils veulent recevoir desAttributs concernant leurs Utilisateurs Finaux de la part des Organismes d'Origine ou de leurAgent afin de rendre leurs services accessibles. Ce Code de Conduite est un codecommunautaire contraignant pour les Fournisseurs de Services qui se sont engagés à lerespecter.
Le travail qui a mené à ces résultats a reçu un financement du Septième programme-cadre (7ème PC
2007-2013) de la Communauté européenne en vertu du Contrat de subvention n° 238875 (GEANT).
Ce travail est © 2012 Dante, utilisé sur base d'une licence Creative Commons Attribution ShareAlike(CC BY-SA 3.0).
Page 1 sur 5

1. Définitionsa) Fournisseur d'Identité (FId): le composant du système qui émet des assertions sur les

Attributs au nom des Utilisateurs Finaux qui les utilisent afin d'accéder aux services
du Fournisseur de Service.
b) Fournisseur de Service (FS): Un organisme chargé de proposer à l'Utilisateur Final lesservices qu'il ou elle souhaite utiliser.
c) Organisme d'Origine: L'organisme à lequel un Utilisateur Final est affilié gérant leFournisseur d'Identité par lui-même ou via un Agent. Il est en charge de la gestion desdonnées d'identité des Utilisateurs Finaux et de leur authentification.
d) Agent: L'organisme gérant, le cas échéant, le Fournisseur d'Identité au nom del'Organisme d'Origine.
e) Attributs: Les données à caractère personnel de l'Utilisateur Final, gérés parl'Organisme d'Origine ou son Agent, tels que notamment le nom, l'e-mail et le rôle ausein de l'Organisme d'Origine.
f) Utilisateur Final: toute personne physique affiliée à un Organisme d'Origine, parexemple un chercheur ou un étudiant utilisant le service d'un Fournisseur de Service.
g) Données à caractère personnel: toute information relative, le cas échéant, à une

personne physique ou morale, identifiée ou identifiable.

2. Principes du Traitement des Attributs
Le Fournisseur de Service accepte et s'engage à:a) [Respect de la législation] ne traiter les Attributs que conformément aux dispositions
pertinentes de la législation relative à la protection des Données à caractère personnel
applicable au Fournisseur de Service;b) [Limitation des finalités] ne traiter que les Attributs de l'Utilisateur Final qui sontnécessaires pour permettre l'accès au service fourni par le Fournisseur de Service;c) [Réduire au maximum les données] limiter les Attributs demandés à l'Organismed'Origine à ceux qui sont adéquats, pertinents et raisonnables en vue de permettrel'accès au service, et, lorsque plusieurs Attributs peuvent être utilisés pour fournir unaccès au service, utiliser les Attributs les moins intrusifs possible;d) [Objectifs détournés] ne pas traiter les Attributs à des finalités autres (par exemple,
Page 2 sur 5

la vente des Attributs ou la vente d'éléments d'identification, tels que l'historique desrecherches, les communications à caractère commercial, les profils) hors ceux
destinés à permettre l'accès, sauf si un consentement préalable a été donné parl'Utilisateur Final au Fournisseur de Service;e) [Conservation des données] supprimer ou mettre sous forme anonymisée tous lesAttributs dès que ceux-ci ne sont plus nécessaires aux fins de la fourniture du service;f) [Parties tierces] ne pas transférer les Attributs à aucune autre partie tierce (telle qu'unpartenaire) sauf
a. s'il a été mandaté par le Fournisseur de Service pour permettre l'accès à son
service en son nom, ou
b. si la partie tierce s'est engagée à respecter le Code de Conduite ou a pris desengagements similaires jugés suffisants en vertu de la législation relative à laprotection des données applicable au Fournisseur de Service ou
c. en cas de consentement préalable de la part de l'Utilisateur Final;g) [Mesures de sécurité] prendre les mesures, techniques et organisationnelles,
appropriées afin de protéger les Attributs contre toute destruction accidentelle ou
illicite ou une perte accidentelle, une modification, une divulgation ou un accès nonautorisés. Ces mesures doivent garantir un niveau de sécurité adapté aux risques liésau traitement et à la nature des données à protéger, eu égard au niveau technologiqueet au coût de leur mise en œuvre.
h) [Obligation d'information vis-à-vis de l'Utilisateur Final] fournir à l'Utilisateur
Final, au moins lors du premier contact, une Politique de Confidentialité accessible
facilement, directement et en permanence, et contenant au moins les informations
suivantes:
a. le nom, adresse et pays du Fournisseur de Service;b. la ou les finalités du traitement des Attributs;c. une description des Attributs traités;d. les destinataires tiers ou les catégories de destinataires tiers à qui les Attributs
peuvent être divulgués, et les transferts proposés d'Attributs vers des pays en
dehors de l'Espace Economique Européen;
e. l'existence des droits d'accès, de rectification et de suppression des Attributs
conservés concernant l'Utilisateur Final;
f. la durée de conservation des Attributs;
g. une référence à ce Code de Conduite

Page 3 sur 5i) [Obligation d'information vis-à-vis de l'Organisme d'origine] : fournir àl'Organisme d'Origine ou à son Agent au moins les informations suivantes:
a. un lien lisible par une machine vers la Déclaration de Confidentialité;
b. indication de l'engagement pris de respecter ce Code de Conduite;c. toute mise à jour ou modification de la législation locale relative à laprotection des Données, qui sont moins stricts que les principes énoncés dansce Code de Conduite;j) [Atteintes à la sécurité] : signaler, sans délai indu, à l'Organisme d'Origine ou à son
Agent tout soupçon d'atteinte à la vie privée ou à la sécurité (notamment lesdivulgations ou atteintes à l'intégrité non-autorisées, la perte, réelle ou possible, dedonnées, documents ou appareils) en rapport avec les Attributs;k) [Responsabilité]: indemniser l'Utilisateur Final, l'Organisme d'Origine ainsi quel'Agent de tout préjudice subi à la suite d'une violation de ce Code de Conduite par leFournisseur de Service comme établi dans une décision judiciaire contraignante etexécutoire;l) [Transfert vers des pays tiers] assurer, lorsque des Attributs sont transférés endehors de l'Espace Economique Européen et des pays assurant une protection desdonnées adéquate conformément à l'article 25§6 de la Directive 95/46/CE, un niveau
de protection adéquat des Données à caractère personnel en prenant les mesuresappropriées conformément à la législation du pays dans lequel l'Organisme d'Origine
est établi, par exemple en demandant l'accord de l'Utilisateur Final ou en concluant
des contrats avec l'Organisme d'Origine sur base des clauses type de l'Union
européenne;m) [Droit applicable et juridiction compétente] faire en sorte que ce Code de Conduite
soit régi par les règles nationales de droit matériel du pays dans lequel est établi leFournisseur de Service, à l'exclusion des règles de droit international privé, et que tout
litige concernant la validité, l'interprétation ou l'application de ce Code de Conduite
soit définitivement tranché par la juridiction compétente du pays dans lequel est établi
le Fournisseur de Service;n) [Pouvoirs pour conclure] faire signer ce Code de Conduite par un représentantdûment autorisé du Fournisseur de Service;o) [Résiliation de ce Code de Conduite] ne mettre fin à son adhésion à ce Code de
Conduite que:a. si celui-ci est remplacé par un accord similaire ou
b. en cas de fin de la fourniture de services à l'Organisme d'origine;p) [Survie des clauses] être tenu par les dispositions de ce Code de Conduite qui, en
raison de leur sens et portée, sont conçues pour subsister après la fin, l'expiration ou la
Page 4 sur 5

nullité de ce Code de Conduite;q) [Primauté] respecter la disposition selon laquelle, en cas de conflit entre une
disposition contenue dans ce Code de Conduite et une disposition de la convention
conclue entre le Fournisseur de Service et l'Organisme d'origine, la disposition ducontrat conclu entre Fournisseur de Service et l'Organisme d'Origine l'emportera surla disposition de ce Code de Conduite.

Page 5 sur 5