...
- use the data controller's legitimate interests as the legal grounds for attribute release
- release only attributes that are flagged as NECESSARY (see SAML 2 Profile for the Code of Conduct for details on how this is done)
- see Introduction to Data protection directive for reasoning
- however, in certain jurisdiction (e.g. Switzerland) user consent may be needed for attribute relase
Deferred until Phase 2 of the
...
Code of Conduct
Note: Introduction to Code of Conduct proposes to defer support to optional extra Attributes to Phase 2.
...