This notice, the IRIS IAM Privacy Notice, is effective from 4th March 2021.
The UK e-Infrastructure for Research and Innovation for STFC (“IRIS”) is a body of peer participant organisations coordinated for the purpose of sharing IT resources and services to further the science goals and missions supported by those organisations.
The IAM (Identity and Access Manager) provides an Authentication and Authorisation Infrastructure (AAI) solution for IRIS. The IAM acts as a proxy service, allowing IRIS collaborators access to other IRIS services.
General principles
IRIS considers it important to process only the personal data required for the proper functioning of IRIS services.
The personal data described below is collected for the purposes of:
- identification;
- authentication;
- authorisation;
- access control;
- accounting;
- billing;
- resource management; and
- information security.
The legal basis for processing this data is the legitimate interests pursued by IRIS and the science communities that IRIS supports in order to provide IT services to its users.
What personal data is collected and why?
Registration
When you register with IRIS IAM to use IRIS services, the following information may be collected and associated with your account:
- Personal name
- Professional email address
- Employing institute
- Science community affiliation and validity dates
- Science community groups and roles
- Professional address and telephone number
- A non-reassigned unique personal identifier, for example the Subject Distinguished Name (DN) from your personal certificate
This information is necessary for security and accounting purposes to uniquely identify and authenticate you when creating an account for access to IRIS services.
Access to IRIS services
When you access IRIS services, records of your access and actions on IRIS resources are created.
These records may contain:
- Your unique identifier
- Your science community group memberships and roles
- The network (IP) address from which you access services
- The date and time of access
- Details of actions performed
In combination with registration information, these records are necessary to support:
- authentication and authorisation;
- resource management and accounting;
- security incident handling;
- analysis of reported problems; and
- contacting users where account-related issues are identified.
How long is personal data retained?
Access logs and accounting records are retained for up to 18 months before being anonymised or deleted.
User registration information is retained for as long as an individual remains a registered member of a Science Community, plus the maximum accounting record retention period.
To support user lifecycle management, including confirming identity if a user returns after a period of absence, IRIS may retain registration information for up to 36 months after membership ends, unless a request is made for earlier removal.
How is personal data protected?
The IRIS IAM is committed to following the REFEDS Data Protection Code of Conduct.
Personal data is protected in accordance with the Code of Conduct for Service Providers, a common standard used within the research and higher education sector to protect privacy.
Personal data is protected from unauthorised disclosure, modification and deletion through appropriate technical and organisational measures, including during transfer between services.
Who has access to personal data?
Personal data is accessible only to individuals authorised by IRIS and only for the purposes described in this notice.
Who may receive personal data?
Personal data may be transferred only where necessary to provide IRIS services, including:
- IRIS participants involved in the provisioning, operation or security of IRIS services;
- trusted third parties involved in security incident response.
No other transfers are permitted unless required by law.
Your rights
You have the right to access the personal data held about you.
You may also request that IRIS:
- correct inaccurate data;
- cease processing your data; or
- delete your data.
If a request cannot be fulfilled, IRIS will explain why.
Please note that changes to or deletion of personal data may affect your ability to access IRIS services.
Legal basis for processing
IRIS uses legitimate interest as the legal basis for processing personal data because it is reasonable and necessary to process such information in order to provide IRIS services in a safe and secure manner.
Contact information
Questions regarding this privacy notice should be sent to:
iris-iam-support@gridpp.rl.ac.uk
Please use the subject line:
ATTN: Privacy Policy
The IRIS IAM service is operated by:
IRIS IAM Team
Scientific Computing Department
Science and Technology Facilities Council
Rutherford Appleton Laboratory
Harwell Campus
Didcot OX11 0QX
United Kingdom
Complaints and supervisory authority
Details of the UK Research and Innovation Data Protection Officer and information on your right to raise concerns with the Information Commissioner’s Office are available via the UKRI privacy notice.
Applicable jurisdiction
The applicable jurisdiction for IRIS IAM is the United Kingdom of Great Britain and Northern Ireland (GB-UKM).
Licence and acknowledgements
This work, “IRIS IAM Privacy Notice”, is licensed by the IRIS Policy Team on behalf of UKRI-STFC under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International licence.
The authors acknowledge contributions from the WLCG and EGI security policy groups.
