Skip to main content
Fachgebiete
Automobil + Motoren Bauwesen + Immobilien Business IT + Informatik Elektrotechnik + Elektronik Energie + Nachhaltigkeit Finance + Banking Management + Führung Marketing + Vertrieb Maschinenbau + Werkstoffe Versicherung + Risiko
DE
EN
Bücher
Zeitschriften
Themenseiten
Organisationspsychologie Projektmanagement Marketing Smart Manufacturing
Weitere Formate
Podcasts Webinare Technik Webinare Wirtschaft Kongresse Veranstaltungskalender Awards
Jetzt Einzelzugang starten
Zugang für Unternehmen
Referenzkunden
SLX-Digitalkonferenz: Zukunftswerkstatt 2024

Mehr Umsatz mit Top-Kontakten

Am 7. Mai erfahren Sie, wie Vertriebsteams Leadgenerierung, Leadnurturing und Leadstrategien effizient steuern können.
Erweiterte Suche
Anmelden
nach oben
Erschienen in:
A Causal Bayesian Networks Viewpoint on Fairness Kapitel lesen Erstes Kapitel lesen

2019 | OriginalPaper | Buchkapitel

Data Protection by Design for Cross-Border Electronic Identification: Does the eIDAS Interoperability Framework Need to Be Modernised?

verfasst von : Niko Tsakalakis, Sophie Stalla-Bourdillon, Kieron O’Hara

Erschienen in: Privacy and Identity Management. Fairness, Accountability, and Transparency in the Age of Big Data

Verlag: Springer International Publishing

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

This paper contributes to the discussion on privacy preservation methods in the context of electronic identification (eID) across borders through interdisciplinary research. In particular, we evaluate how the GDPR principle of ‘Data Protection by Design’ applies to the processing of personal data undertaken for identification and authentication purposes, suggesting that, in some cases, unlinkable eIDs should be a key requirement in order to facilitate data minimisation and purpose limitation. We argue that in an attempt to welcome diverse types of architectures, the Interoperability Framework could have the effect of reducing the data protection level reached by some national eID schemes, when transacting with services that do not require unique identification. We consequently propose that data minimisation and purpose limitation principles should be facilitated through the implementation of two methods, pseudonymisation and selective disclosure, through an addition to eIDAS’ technical specifications.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Jetzt informieren
Vorheriges Kapitel Assessing Theories for Research on Personal Data Transparency
Nächstes Kapitel Risk Profiling by Law Enforcement Agencies in the Big Data Era: Is There a Need for Transparency?
Fußnoten
2
Regulation (EU) No 910/2014 of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC [2014] OJ L257/73.
 
3
eIDAS Rec. 2.
 
4
eIDAS Rec. 12.
 
5
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance), OJ L119/1.
 
6
GDPR Art. 1(3).
 
7
GDPR Rec. 5 “The economic and social integration resulting from the functioning of the internal market has led to a substantial increase in cross-border flows of personal data”.
 
8
GDPR Art. 1(2).
 
9
A term first coined by Ann Cavoukian [10, 11] but referring to concepts that started to emerge in privacy literature since the 1970s; see, for example, [12, 13, 30].
 
10
Which are considered less effective, “an afterthought” [40].
 
11
eIDAS Rec. 27: “This Regulation should be technology-neutral. The legal effects it grants should be achievable by any technical means provided that the requirements of this Regulation are met”.
 
12
See eIDAS Rec. 17: “Member States should encourage the private sector to voluntarily use electronic identification means under a notified scheme for identification purposes when needed for online services or electronic transactions.” See also [44], p. 2: “the Commission will further promote interoperability actions, including through issuing principles and guidance on eID interoperability at the latest by 2017. The aim will be to encourage online platforms to recognise other eID means – in particular those notified under the eIDAS Regulation (EC) 910/2014 – that offer the same reassurance as their own”.
 
13
eIDAS Art. 12.
 
14
eIDAS Art. 8(3) and [22].
 
15
eIDAS Art. 3(3): “a set of data enabling the identity of a natural or legal person, or a natural person representing a legal person to be established”.
 
16
IR 2015/1501 ANNEX 1.
 
17
IR 2015/1501 ANNEX 1(d).
 
18
ibid.
 
19
GDPR Art. 94(2): “References to the repealed Directive shall be construed as references to this Regulation”.
 
20
eIDAS Rec. 11: “authentication for an online service should concern processing of only those identification data that are adequate, relevant and not excessive to grant access to that service online”.
 
21
GDPR Art. 25(1).
 
22
GDPR Art. 28(1): “[data controllers] shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures”.
 
23
GDPR Rec. 78.
 
24
GDPR Art. 25(1).
 
25
GDPR Art. 83(4)(a).
 
26
GDPR Art. 25(1); the qualification will be determined, among others, through a data protection impact assessment.
 
27
Confidentiality under GDPR Art. 5(1)(f); integrity under Art. 5(1)(f); availability under Art. 32(b) in relation to Art. 5(1)(f); transparency under Art. 5(1)(a); intervenability under Art. 5(1)(d) and (e) in relation to Arts. 15–22; unlinkability under Art. 5(1)(c) and (e); data minimisation under Art. 5(1)(c).
 
28
GDPR Art. 5(1)(c).
 
29
GDPR Art. 5(1)(b).
 
30
“[Unlinkability] ensures that a user may make multiple uses of resources or services without others being able to link these uses together [...] Unlinkability requires that users and/or subjects are unable to determine whether the same user caused certain specific operations in the system” [35].
 
31
For a detailed analysis of how the Interoperability Framework meets the data protection goals, see [47].
 
32
eIDAS Art. 12(4)(d).
 
33
Commission Implementing Regulation (EU) 2015/1501 Art. 6(2).
 
34
Commission Implementing Regulation (EU) 2015/1502 ANNEX 2.3.1.
 
35
ibid, ANNEX 2.4.6.
 
36
eIDAS Art. 11(1) and 11(3).
 
37
Commission Implementing Regulation (EU) 2015/1502 ANNEX 2.4.4 and 2.4.6.
 
38
ibid, ANNEX 2.4.2.
 
39
See [3] where the authors define the two as “strong” and “weak” unlinkability.
 
40
Excerpts from the interviews are not included in this paper due to space constraints. For a transcript of the experts’ opinions, see Sect. 8 and the appendix in [47].
 
41
GDPR Art. 4(5).
 
42
“the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;” [emphasis given].
 
43
For a thorough explanation of this argument, see [48].
 
44
GDPR Art. 5(1)(c): “limited to what is necessary in relation to the purposes”.
 
45
GDPR Art. 5(1)(e): “for no longer than is necessary for the purposes for which the personal data are processed”.
 
46
GDPR Art. 5(1)(b): “not further processed in a manner that is incompatible with those purposes”.
 
47
This is an issue with ‘pairwise persistent’ pseudonyms. In a case where two or more services merge together, pairwise persistent pseudonyms can potentially allow linkability depending on the existence of other common identifiers in the dataset.
 
48
Privacy-aware eID schemes have started to deploy alternative architectures to sidestep the privacy concerns of pairwise-persistent pseudonyms. See, for example, the implementation of Gov.UK Verify, where a hub in between the Identity and Service Provider mediates all communication in order to obscure the one from the other [27] (cf. though [46] on potential risks); in contrast, the approach taken by the German nPA scheme is to generate pseudonyms locally in the user’s eID token.
 
49
The basic premise behind the system’s design is that the identifying set of information, referred to as a “sovereign data set”, has greater value after validation as trustworthy by an official source and therefore deserves greater protection.
 
50
Although strictly speaking there is a central Identity Provider operated under the Federal Ministry of the Interior; however its role is to authenticate the service providers, not the users.
 
51
German law is rich in privacy-enhancing principles. At the core is the ‘right to information self-determination’ which is a German inception. It confers the right to decide when and within what limits information about one’s self should be communicated to others [31]. The right stemmed from a decision of the German Constitutional Court: Volkszählungsurteil 1 BvR 209/83, BVerfGE 65 E 40 1ff. The Court further prohibited any future creation of a persistent unique identifier, ibid s 1. Public authorities operate under a ‘separation of informational powers’ – they are not allowed to collate data, as the state should not operate as a single entity, and all data transfers have to be justified against the principles of ‘purpose specification’ and ‘proportionality’ [8].
 
53
See for more [47] pp. 48–64.
 
54
ibid, Appendix.
 
56
eIDAS Art. 12(3)(c).
 
57
eIDAS Art. 5(2).
 
58
This is also the position of the ABC4Trust project in [2], which was published before the GDPR, and hence before Data Protection by Design was elevated to a requirement.
 
59
The four use cases are indicative examples about the benefits of eIDAS by the eGovernment and Trust team: https://​ec.​europa.​eu/​digital-single-market/​en/​trust-services-and-eid.
 
60
An e-government concept that citizens and businesses provide diverse data only once in contact with public administrations, while public administration bodies take actions to internally share and reuse these data. The ‘once-only principle’ was one of the targets of the EU’s ‘eGovernment Action Plan 2016–2018’ [21] and the reason behind the EU’s ‘Single Digital Gateway’: http://​www.​europarl.​europa.​eu/​news/​en/​headlines/​economy/​20180911STO13153​/​single-digital-gateway-a-one-stop-shop-for-all-your-online-paperwork.
 
61
See prohibition of the German Constitutional Court above Footnote 51.
 
62
The decision might be related to how services in Germany are authorised to access the eID data: services have to file an application with the Federal Office of Administration, listing all the attributes they wish to have access to along with how the attributes relate to the processing purposes [51]. The decision to treat all public-sector services of a Member State as one, and therefore request a combined authorisation, might be in an attempt to make the process easier for the receiving Member State’s authorities.
 
63
In Footnote 42 and related discussion.
 
64
See further analysis in [48].
 
65
Among others: processing that affects a significant proportion of the population, using data items in high volumes or on a wide scale, with a significant processing duration and in a large geographical extent.
 
66
The national systems, the deployed eIDAS nodes and the service providers communicate through defined queries and answers in Security Assertion Markup Language (SAML) [18].
 
67
See 6.2 SAML AuthnRequest in [19]. Of note, the equivalent SAML profile of the STORK 2.0 project, which formed the basis of eIDAS, was capable of selective disclosure (see 4.1.4.8.1 in [45]).
 
Literatur
1.
2.
3.
4.
Article 29 Data Protection Working Party: statement on the role of a risk-based approach in data protection legal frameworks. WP 218, 30 May 2014
5.
Article 29 Data Protection Working Party: Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679. WP 248 rev 0.1, 4 April 2017
6.
Bieker, F., Friedewald, M., Hansen, M., Obersteller, H., Rost, M.: A process for data protection impact assessment under the european general data protection regulation. In: Schiffner, S., Serna, J., Ikonomou, D., Rannenberg, K. (eds.) APF 2016. LNCS, vol. 9857, pp. 21–37. Springer, Cham (2016). https://​doi.​org/​10.​1007/​978-3-319-44760-5_​2CrossRef
7.
Bishop, M.: Introduction to Computer Security. Addison-Wesley Professional, Boston (2004)
8.
Burkert, H.: Balancing informational power by informational power or Rereading Montesquieu in the internet age. In: Brousseau, E., Marzouki, M., Méadel, C. (eds.) Governance, Regulation and Powers on the Internet, Book Section 4, pp. 93–111. Cambridge University Press, Cambridge (2012)CrossRef
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
Hes, R., Borking, J. (eds.): Privacy-Enhancing Technologies: The Path to Anonymity, Revised edn. Registratiekamer, The Hague (2000)
31.
32.
Horsch, M., Tuengerthal, M., Wich, T.: SAML privacy-enhancing profile. In: Hühnlein, D., Roßnagel, H. (eds.) P237 - Open Identity Summit 2014, pp. 11–22. Gesellschaft für Informatik e.V, Bonn (2014)
33.
Hühnlein, D., et al.: Futuretrust - future trust services for trustworthy global transactions. In: Hühnlein, D., Roßnagel, H., Schunck, C.H., Talamo, M. (eds.) P264 - Open Identity Summit 2016, pp. 27–41. Gesellschaft für Informatik eV, Bonn (2016)
34.
35.
ISO/IEC 15408–1:2009: Information technology - security techniques - evaluation criteria for it security - part 1: Introduction and general model, International Organization for Standardization, Geneva, CH (2009)
36.
ISO/IEC 27002:2013: Information technology - security techniques - code of practice for information security controls, International Organization for Standardization, Geneva, CH (2013)
37.
ISO/IEC 29134:2017: Information technology - security techniques - guidelines for privacy impact assessment, International Organization for Standardization, Geneva, CH (2017)
38.
39.
Koning, M., Korenhof, P., Alpár, G.: The ABC of ABC - an analysis of attribute-based credentials in the light of data protection, privacy and identity. In: Balcells, J. (ed.) Internet, Law & Politics : A Decade of Transformations. Proceedings of the 10th International Conference on Internet, Law & Politics, Universitat Oberta de Catalunya, Barcelona, 3–4 July, pp. 357–374. Huygens Editorial, Barcelona (2014). http://​edcp.​uoc.​edu/​proceedings_​idp2014.​pdf
40.
Le Métayer, D.: Privacy by design: formal framework for the analysis of architectural choices. In: Proceedings of the Third ACM Conference on Data and Application Security and Privacy (CODASPY), San Antonio (2013)
41.
42.
43.
Roßnagel, H., et al.: FutureID - shaping the future of electronic identity. In: Annual Privacy Forum 2012, Limassol, Cyprus, 10–11 October 2012
44.
45.
46.
Tsakalakis, N., O’Hara, K., Stalla-Bourdillon, S.: Identity assurance in the UK: technical implementation and legal implications under the eIDAS regulation. In: Proceedings of the 8th ACM Conference on Web Science. WebSci ’16, pp. 55–65. ACM, New York (2016). https://​doi.​org/​10.​1145/​2908131.​2908152
47.
48.
Tsakalakis, N., Stalla-Bourdillon, S., O’hara, K.: What’s in a name: the conflicting views of pseudonymisation under eIDAS and the general data protection regulation. In: Hühnlein, D., Roßnagel, H., Schunck, C.H., Talamo, M. (eds.) P264 - Open Identity Summit 2016, pp. 167–174. Gesellschaft für Informatik e.V., Bonn (2016)
49.
50.
Yee, G.O.M.: Privacy Protection Measures and Technologies in Business Organizations: Aspects and Standards. IGI Publishing, Hershey (2011)
51.
Zwingelberg, H.: Necessary processing of personal data: the need-to-know principle and processing data from the new German identity card. In: Fischer-Hübner, S., Duquenoy, P., Hansen, M., Leenes, R., Zhang, G. (eds.) Privacy and Identity 2010. IAICT, vol. 352, pp. 151–163. Springer, Heidelberg (2011). https://​doi.​org/​10.​1007/​978-3-642-20769-3_​13CrossRef
52.
Metadaten
Titel
Data Protection by Design for Cross-Border Electronic Identification: Does the eIDAS Interoperability Framework Need to Be Modernised?
verfasst von
Niko Tsakalakis
Sophie Stalla-Bourdillon
Kieron O’Hara
Copyright-Jahr
2019
Buch
Privacy and Identity Management. Fairness, Accountability, and Transparency in the Age of Big Data

Print ISBN: 978-3-030-16743-1

Electronic ISBN: 978-3-030-16744-8

Copyright-Jahr: 2019

DOI
https://doi.org/10.1007/978-3-030-16744-8_17