<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I don't know that it is practical to register purpose of use at registration.<div><br></div><div>I was thinking that that would eventually become part of the claim request meta-data, along with value and required trust framework etc.</div><div><br></div><div>It makes the request larger but is more flexible. </div><div><br></div><div>The other place to list that would be in some third party certified meta-data.</div><div><br></div><div>I could see checking with a meta-data repository if a RP is certified for EU safe harbour, and what attributes they are approved to collect.</div><div>That is sort of what Germany is doing now with there EID.</div><div><br></div><div>John<br><div><div>On 2011-07-23, at 4:02 AM, Nat Sakimura wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi. <div><br></div><div>I have started to contemplate on the privacy considerations. </div><div><br></div><div>Several questions arises: </div><div><br></div><div>- When is the purpose of the use of the attribute determined? </div>
<div> -> either the claim request, or the redirect_url registration time. </div><div>- Is it not a good practice to return the terms of use of the data with it? </div><div>- Is it not releasing too much information as a default? </div>
<div>- Should not the access log to the UserInfo made accessible to the user? </div><div><br></div><div>Best, <br clear="all"><br>-- <br>Nat Sakimura (=nat)<div>Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en</div><br>
</div>
_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>http://lists.openid.net/mailman/listinfo/openid-specs-ab<br></blockquote></div><br></div></body></html>