search

new-zealand-research-information-system / nzris-data-specifications

4 stars 0 forks source link

API model for persons lacks granular privacy Take II #15

Open Jason-Gush opened 5 years ago

Jason-Gush commented 5 years ago

Transferred from API Spec issues as this is a better home:

'persons' as a entity have a single protectionRequirements block, i.e., everything about a person shares the same protection. In most instances this will make everything about a person protected.

What is needed is the ability to specify protection for each of: "dateOfBirth" "gender" "genderOtherInformation" "ethnicity" - each item "iwiAffiliation" - each item "sectorPersonIds" - each item "researchCareerStage" - each item "academicRecord" - each item "recognition" - each item "professionalBodies" - each item "organisationAffiliations" - each item With the current model, to publish someone's name appears to also require publishing their DOB, gender, and ethnicity.

The proposed solution for phase I is to only submit the mandatory & already public This helps, but leaves the status of 12.1 "Local Person ID" aka localPersonId (both mandatory and a protected field) uncertain.

What might be needed is clear statements on how NZRIS will treat this value, and a commitment that this value will not be exposed by the system.

amily-kim commented 5 years ago

Hi Jason, thanks for dress this up here and the suggested solution, we will definitely keep this in our backlog.