...
GEANT central operations | NROs | |
Dataset description: | Institution information (IdP or SP), participating in eduroam service. | Institution information (IdP or SP) participating in eduroam service and belonging to the given NRO. |
Purpose of processing: | Data is used to feed the central data repository for eduroam service. It provides information about Institutions that participate in the eduroam service as IdPs and SPs. The data is used for providing public available information about eduroam service, available at https://monitor.eduroam.org/. | Data is requested by the eduroam service definition. |
Data source: | The eduroam database has been build as a central database with the mechanism that enables automatic data collection from (National) Roaming Operators - (N)ROs. (N)ROs should provide general data in the defined XML or JSON format. The data should be available at the specific, predefined URLs: http://www.eduroam.<tld>/general/<dataset-name> | Data is collected from the institutions participating in the eduroam in that NRO. Exact process is a matter of local implementation in a NRO. |
Data storage and access: | Data is stored in the SQL database on the host that is operated in the infrastructure provided by CARNet. The raw data is accessible only by the personnel of eduroam operations team (OT). THe host is mantained by the OT | Data is stored in the national eduroam web site. Data access is public. Additional storing locations may be implemented based on NROs practices. |
Data transfer: | Data is not transferred to any other party or system. | - |
Data retention: | Data is kept permanently. | |
Personal data processed: | Yes | Yes |
...
GEANT central ops | NROs | |
Dataset description: | Service Location information | Service Location infromations, from SPs belonging to the given NRO. |
Purpose of processing: | Data is used to feed the central data repository for eduroam service. It provides information about Service Locations that are provided in eduroam by participating SPs. The data is used for providing public available information about eduroam service, available at https://monitor.eduroam.org/. | Data is requested by the eduroam service definition. |
Data source: | The eduroam database has been build as a central database with the mechanism that enables automatic data collection from (National) Roaming Operators - (N)ROs.(N)ROs should provide general data in the defined XML or JSON format. The data should be available at the specific, predefined URLs: http://www.eduroam.<tld>/general/<dataset-name>. | Data is collected from the service providers participating in the eduroam in given NRO. Exact process is a matter of local implementation in a NRO. |
Data storage and access: | Data is stored in the SQL database that is operated in the infrastructure provided by CARNet/SRCE. The raw data is accessible only by the personnel of eduroam operations team. | Data is stored in the national eduroam web site. Data access is public. Additional storing locations may be implemented based on NROs practices. |
Data transfer: | Data is not transferred to any other party or system. | - |
Data retention: | Data is kept permanently. | |
Personal data processed: | Yes | Yes |
...
Dataset description: | Configuration Assistant Tool operator database (NRO administrator and institution-level administrator) |
Purpose of processing: | allowing administrators to upload and maintain the information needed to create eduroam installation programs ("installers") within their country / institution |
Data source: | eduroam database - NRO information & institution information (see datasets above), eduroam SP proxy authentication data (see dataset above), administrator input, produces web server and application logs (cat-ams.eduroam.org) |
Data storage and access: | this needs to be filled in by the sys admins of cat-ams Data is stored in the SQL database on the virtual machine that is operated in the infrastructure provided by SURFNET. The raw data is accessible only by the personnel of eduroam operations team. The virtual machine is maintained by the OT. |
Data transfer: | System sends emails with invitation tokens (one variant to institution administrators for sign-up, one variant to NRO personnel for general status updates) |
Data retention: |
|
Personal data processed: | Yes |
...
Dataset description: | eduroam Managed IdP is a derivative of eduroam CAT (see above), which additionally produces per-user personalised installation programs and maintains a database of these end users. It also authenticates the end users based on the installed programs |
Purpose of processing: | allowing administrators to upload and maintain the information needed to manage their end user base to the end of creating eduroam installation programs ("installers") within their country / institution, and to authenticate their users in eduroam |
Data source: | eduroam database - NRO information & institution information (see datasets above), eduroam SP proxy authentication data (see dataset above), administrator input, produces web server and application logs (cat-pilot.eduroam.org / auth-test.hosted.eduroam.org / auth-test-2.hosted.eduroam.org / ocsp-test.hosted.eduroam.org) |
Data storage and access: |
|
Data transfer: | System sends emails with invitation tokens (one variant to institution administrators for sign-up, one variant to end-users for credentialing, one variant to NRO personnel for general status updates) |
Data retention: |
|
Personal data processed: | Yes |
Dataset content
Data item | Is personal data ? | |
---|---|---|
1-5 | Dataset content items 1 to 5 are IDENTICAL to those of eduroam CAT (see above) | Yes |
6 | Deployment details of Managed IdP for NRO (from NRO admin input)
| No |
7 | Deployment details of Managed IdP for institution
| Yes because of pseudonymous usernames ? |
8 | eduroam credentials (X.509 certificates)
| ? |
9 | end-user invitation tokens (URLs with unique, random long identifier)
| ? |
10 | RADIUS authentication logs The RADIUS server is an eduroam IdP in the sense of the dataset "eduroam RADIUS server logs → IdP" above, and the same data set considerations apply. | Yes |
11 | certificate status server logs
|
Description of fields
The details of service related datasets (data collections) should be filled with a list of all kinds of data which is collected or processed by this service. The table should be filled by the Service Manager and afterwards reconciled with the GEANT Data Protection Officer in order to address GDPR requirements. One service often incorporates several datasets. <dataset_name> - name of dataset (collection of data processed in similar way). Dataset description: brief explanation of the kind of information or entities the dataset contains. Purpose of processing: what is purpose of data collecting and processing. Data source: what are source(s) of data - list of services, systems, applications, databases or similar source components, including user's input, from which data are being received. E.g. RIPE database, service ABC, organisation LDAP directory... Data storage and access: describe where the data are stored, backup-ed etc. and who has access to the data. Data transfer: list of other services, systems, applications, databases or similar destinations to which data are being sent. E.g. RIPE database, service ABC, GÉANT's database XYZ... Data retention: describe data retention policy ie. for how long data are stored before being deleted. E.g. 1 year, 2 years after contract ending, forever... Dataset content
|
...