Location Constraints

[PrivacyCDN]

Potential Location Contraints

This issue came to mind in the course of a discussion around issue 239 in the workgroup call of 2016/02/04, but is unrelated to that issue. The simple use case would be where a resource owner is a citizen of a country that has data localization regulations that bar the collection, use or disclosure of citizen data in all or some other countries. For example, European data controllers may not transfer European citizens' data to countries that have not been approved for such transfers.

If Bob is the Resource Owner and he wants to grant access to his personal information, stored on a Resource Server in his own country, to a Requesting Party (Alice) located in another country, the Authorizing Server may be required to deny access because Alice is in a country that is not approved to collect personally identifiable information from Bob's country, irrespective of Bob's expressed consent.

Another case might be where a medical researcher wants to share health data with a colleague in another location. Is this disclosure allowed by the medical researcher's institution and does the researcher have to seek consent from the patient in advance of the disclosure?

Factors to consider:

• Is the type of resource such that location constraints may apply (i.e. is it personally identifiable information)
• The location of the Resource Server
  • Physical location in the case of government regulations - what constraints apply to cross border data transfers
  • Logical location in the case of policies related to scope - what constraints apply to data transfers within entities (Local), within federations (medium scope), or just generally.
• The location of the Requesting Party - Is the requesting party in a physical or logical location that places constraints granting access.

[xmlgrrl]

This is a classic RSctrl question. I've added shoebox because of the potential implications.

[xmlgrrl]

Andi and I wonder: Is this "just" a case of implemented AS policy sophistication, and not a spec change?