Evolving Attribute Release Policies for campuses

[Cantor, Scott]

> What we have in terms of a consent policy is still in flux. I can tell you what
> Illinois is considering, though. The big draw of enabling consent is so that we
> can start releasing attributes for our users who have elected FERPA
> suppression, or more accurately allow those users to make that call.

That is our plan, and I will likely use the terms of use flow for that, rather than the consent flow. The question of global vs. per-service is an interesting one though, and I don't know what we'll do about that, but I'm inclined to believe it simply isn't workable to force a user to go through that consent every single time they access something subject to it.

> We'll still let the consent page be displayed for all users, even those who aren't FERPA
> suppressed. It's good to let users know what they're sharing when they log
> into something, putting them in control of their own identity.

I probably will not push for that simply because it will turn into a major argument over changing the existing behavior of the system for everybody vs. a change to fix a bug for a small group.

> For InCommon and eduGAIN, we are leaning toward only displaying a
> consent screen for services that aren't global R&S. The excellent work that
> went into global R&S as it relates to data stewardship and storage gives our
> registrar a lot of confidence in those services.

I believe we'll be deploying the FERPA-driven acceptance page for all services subject to our default policy, which is not based on R&S now and covers all of eduGAIN.

-- Scott