Page History

Participants discussed the proposed explanatory memo that Mikael has shared.  Mikael has changed the introduction to focus more on the reasons why we are doing this.  The main areas of consideration now are:

• Monitoring.
• Organisational description of GÉANT. 

The issue with monitoring was discussed at length: at the moment we only have the capability to monitor eduGAIN entities.  There is a wish on the part of some federations to be able to apply CoCo locally but this would mean that:

• GÉANT would have to find a way to monitor this additional metadata.
• GÉANT would need to have agreements in place with the NRENs on monitoring and find a way to enforce this.

OR

• NRENs would need to fork the CoCo and set up their own monitoring / register as a monitoring body. 

Our interpretation of the GDPR text is that there can only be one monitoring body per Code.

This is a very complicated position to explain to the Dutch DPA and something that will take time and resource to put in place, which could slow down our ability to move forward with CoCo.  It was agreed that in phase 1, we should push for CoCo that only covers eduGAIN entities and encourages federations to put any entity that uses CoCo into eduGAIN.  A phase 2 could look at extending this when the first use case is understood, implemented and shown to work. 

•  Mikael Linden to update the explanatory memo with outcome of this monitoring discussion. 
•  Nicole HarrisBrook SchofieldAna AlvesMagdalena Rzacato discuss and provide information for the organisational position within the explanatory memo by 23 May 2019.
  

Mikael is still waiting for feedback on when a call with SCOPE will be possible.

•  Mikael Lindento share meeting time for meeting with SCOPE when confirmed with the group.
  

Pål raised the issue of whether the name of the current CoCo should be changed as is it specifically about federated identity and could restrict other GÉANT Codes in other areas (e.g. cloud).  It was felt that whilst we plan to limit the initial phase of the CoCo monitoring to eduGAIN, using the eduGAIN name itself here was not helpful.  It is also not a well known brand (purposefully) with users.  We like the idea of including GÉANT's name in the title, especially if GÉANT will be responsible for the monitoring body, but there needs to be something else. 

Mikael suggested that "GÉANT Code of Conduct for Federated Identity" could be appropriate.  Everyone was in agreement that this met the requirements. 

•  Mikael Lindento raise the name change with DLAPiper to see if they are in agreement.