The REFEDS Data Protection Code of Conduct v2

The REFEDS Data Protection Code of Conduct v2 (CoCo v2) is an entity category used in federation metadata to indicate that a Service Provider (SP) has applied for membership of the REFEDS Data Protection Code of Conduct and has been reviewed and approved by the UK federation Registrar against the (CoCo v2) registration criteria. The entity category helps Identity Providers (IdPs) make informed decisions about releasing user attributes to an SP. For an IdP, the presence of the (CoCo v2) entity category indicates that the SP has met a recognised set of data protection and transparency requirements, enabling the IdP to more confidently assess whether the release of personal data to that SP is appropriate and compliant with its local policies and legal obligations.

Please Note: Unlike earlier versions of the Code of Conduct, this entity category is NOT self-asserted by the SP. By asserting the entity category, the UK federation Registrar claims that the SP has applied for membership, complies with the (CoCo v2) registration criteria, and that its application has been reviewed and approved in accordance with the REFEDS Data Protection Code of Conduct v2 specification.

• Prerequisites
• How do I request that my SP shows it follows the Code of Conduct v2?
• What must be in the request?
• What happens next?
• How do I request to show that my IdP supports the Code of Conduct?
• Other information

Prerequisites

SP operators should be familiar with the REFEDS Data Protection Code of Conduct Entity Category and REFEDS Data Protection Code of Conduct v2 Best Practice Guidelines before contacting the helpdesk.

You should be familiar with the UK federation's guidance on RequestedAttribute elements in an SP's metadata.

How do I request that my SP shows it follows the REFEDS Data Protection Code of Conduct v2?

To request that your Service Provider (SP) is assigned the REFEDS Data Protection Code of Conduct v2 entity category, send an email to the UK federation service desk.

Before submitting your request, please review the required information listed below to confirm that your SP meets the initial requirements. The CoCo v2 email application template request will help you supply all the information needed by the UK federation team to process your request.

What must be in the request?

• The request MUST include an entityID for a registered SP (or be part of a new entity registration request).
• The request MUST be emailed to us by an appropriate person. In the case of an existing entity, this would be the Administrative contact for the entity or Management Contact for the organization. New registration requests must always come from an organization's Management Contact. (A description of the various roles is available here.)
• The request MUST contain a statement that you will inform the UK federation of any material changes that affects the Service Provider's ability to comply with the REFEDS Data Protection Code of Conduct v2, such as below:
  • We will inform the UK federation of any material changes that may affect our ability to comply with the REFEDS Data Protection Code of Conduct v2.
• The request MUST state the Service Provider commits to REFEDS Data Protection Code of Conduct v2 and Best Practice Guidelines, such as below:
  • I confirm that I am authorised to act on behalf of the Service Provider organisation and that the organisation has reviewed and committed to supporting the REFEDS Data Protection Code of Conduct v2 Best Practice Guidelines. I understand the obligations associated with the REFEDS Data Protection Code of Conduct v2 and confirm that the service is operated in accordance with those requirements.
• The request MUST state that the Service Provider has stated the legal grounds under which it supports the transfer of personal data under the GDPR, stating what country or if the SP is European Union based. If the organization's country has an adequacy decision pursuant to GDPR Article 45, this must be specified:
  • Operating in a country bound by the data protection laws within the European Union or European Economic Area (Iceland, Liechtenstein and Norway) or a country, territory, sector or international Organisation with an adequacy decision pursuant to GDPR Article 45.
  • Using appropriate safeguards pursuant to GDPR Article 46 and committed to only receiving data from organisations where safeguards have been agreed.

The Service Provider's metadata should contain the information listed below. Where any of the required information is not present in the metadata, it must be provided as part of the CoCo v2 request. The request must therefore include any missing items from the following requirements:

• The Service Provider MUST be compliant with the Security Incident Response Trust Framework for Federated Identity (Sirtfi) and MUST include at least one Sirtfi security incident response contact as part of the request.
• The request MUST include the following MDUI Requirements, and there MUST be at least one value with xml:lang="en" present, however, there can be more than one other value with xml:lang present:
  • At least one mdui:DisplayName value.
  • At least one mdui:Description value. The description should be understandable and useful to end users. A maximum length of 140 characters is recommended.
  • At least one mdui:PrivacyStatementURL value. The mdui:PrivacyStatementURL value MUST resolve to a Privacy Notice which is publicly accessible to browser users without requiring authentication of any kind. There may be more than one mdui:PrivacyStatementURL. Each one MUST have a unique xml:lang attribute, although they could conceivably all have the same URL if the document has sections for the different languages.
• If the Service Provider requires a SAML Subject Identifier, the request MUST include include a subject-id:req entity attribute extension. The subject-id:req entity attribute must clearly indicate which identifier is required:
  • subject-id or pairwise-id.
• The SP's metadata MUST include RequestedAttribute elements to explicitly state which attributes it needs, and those attributes MUST be consistent with its privacy notice. Each requested attribute must be relevant to the operation of the service. Any attribute that is necessary for access to the service MUST include: isRequired="true". Please note that the core attributes for the UK federation are defined in the eduPerson schema (see section 7 of the UK federation Technical Recommendations for Participants) whilst other federations may use attributes from other schemas e.g. SCHAC. Information on the form of the RequestedAttribute information can be seen on the Shibboleth wiki, or contact the UK federation service desk for more information.

What happens next?

The UK federation support team will review your request and will advise the requestor if the request requires additional information or if it has passed or failed our review, if it has passed we will advise when the SP's metadata will be updated.

How do I request to show that my IdP supports the Code of Conduct?

Home Organisations that operate Identity Provider (IdP) services are not required to commit to the Code of Conduct for Service Providers. However, as data controllers for their end users, Home Organisations may wish to take steps to manage the release of attributes to Service Providers and mitigate associated risks.

To enable support for the entity category attribute on an IdP, the Administrative Contact for the entity or Management Contact for the organization must send an email to the UK federation service desk, at service@ukfederation.org.uk, requesting that the entity category support attribute should be added to the IdP.

Other information

Note: The UK federation reserves the right to review any Service Provider's eligibility for an Entity Category at any stage of the registration process and throughout the lifetime of the registration. As part of this process, the UK federation may request additional information, clarification, or supporting evidence to verify compliance with applicable requirements and policies.

The UK federation also reserves the right to revoke an Entity Category from a Service Provider at any time if the SP can no longer demonstrate a commitment to the REFEDS Data Protection Code of Conduct v2. This may occur in a variety of circumstances, including, but not limited to, complaints from an Identity Provider (IdP) regarding an SP's failure to comply with the REFEDS Data Protection Code of Conduct v2. In such cases, the UK federation will conduct a review and may take appropriate action, including the revocation of the Entity Category and, where applicable, the submission of reports relating to potential GDPR breaches.