The DutchGrid CA service provides identity assertions to individual
persons for use in electronic authentication. By their very nature,
these identity assertion are linked to your personal data -- they
are used to provide your identity to third parties with which you
communicate.
During the application and certification process with the
DutchGrid CA, your personal data will be processed and stored.
Why?
- This data enables the CA to ensure that the certificate is
issued the the proper person, and especially that the same
subject name is never assigned to different people.
-
This data is also retained by the CA to contact the subscriber
(i.e. you) with service notifications, such as (but not limited to)
the reminder sent to you a few weeks before your certificate expires.
These notices will not be frequent, and will always be sent by
the DutchGrid CA.
-
Your data may be disclosed to law enforcement, if so authorized
according to Dutch Law. This could be the case when your certificate
has been used for illegal activities.
Of the data you provide, the contents of the certificate itself, in
particular the subject name will be disclosed to the public, and
this audience can be both inside and outside of the European Union.
Keep in mind that your certificate data will be exchanged in cleartext
whenever you send your certificate to establish a secure connection.
If your certificate contains your email address (but this is optional
and not the default!), this email address will be publicly visible.
Protecting the data in your certificate during its daily use is outside
the control of the CA.
The DutchGrid CA consists of the DutchGrid CA Management Authority and
the DutchGrid CA Operator. They will not share your data with any other party.
The following information is collected from the application on
the registration form (the registration form is then kept on paper
only, in a locked, secure environment with recorded access):
- Full name as stated on the government issued photo ID
used to generate the certificate subject name
- Date and place of birth and nationality
used together with the name and identity piece serial number
to make sure it is the same person that attempts renewal of
a certificate
- Serial numbers of the identity piece shown
In order to facilitate re-authentication with a different identity
piece in the future (e.g. using a different passport or
driver's license), we request your SOFI number as well. You
may decline to provide this, and it will not affect your
application process. It may affect the renewal process later.
- Work address and phone number
Used to contact the subscriber in normal cases. Having a
work address is compulsory, and is used to make sure that the
applicant is part of the DutchGrid constituency (i.e.
acedemia, research and higher education in the Netherlands).
- Home address and phone number
Used to contact the person in case of problems, in case
the user has left the organisation. Since the user is not
required to keep location information up to date over the
one-year validity period, it is unsure if the subscriber is
still working with the organisation. In those cases, your
home address will be used - we will not normally contact you
at your home address.
- Electronic mail address
Used to send the certificate to, as well as renewal warnings
and service messages
- Signature place and time, and signature
this binds the applicant to the Policy and Practice statements,
and signifies that the data above is complete and correct.
When contacting the RA, you will be asked to provide a photocopy
of your ID. This photocopy is only used to cross-check the validation
done by the RA by the CA, and is subsequently destroyed. In particular,
only the type and number of your national ID is archived; no
copies of it are stored by the RA or CA.
If you prefer not to hand over a copy of your ID, please contact
an RA that is except from this cross-check procedure, or validate
directly with the CA central RA service.
Some information is also kept on-line. The on-line information
systems contain:
- All electronic correspondence with the CA, both in-bound and
out-bound.
- For each processed request, the RA address, the country of
issuance and the serial number of the identity piece, and
the dates and times of contact with the applicant.
- Any correspondence of validation, checks and renewals bewteen
the CA and the RA(s) regarding renewal requests.
Access to this on-line information is limited to CA management
and operators only, but an off-site backup exists. A determined
attacker might use physical violence to get access to this data.
Note that all data at the CA could be used by law enforcement officials
if ever your certificate use is subject to a criminal investigation.
The CA cannot legally prevent access to this information in that case.
|
Getting Information About Your Data |
You can request access to information regarding all your data at any time.
And you can of course request your data to be corrected.
Due to the nature
of the certificate service, you will have to agree to storage of your
data with the CA, for the purpose for issuing, validating and
renewal of identity assertions. You have been been or will be notified in
advance that your data will be stored -- as a warning at the top of
the electronic application form, and via the CP/CPS with which you
officially agreed when signing the paper-based application form.
The electronic mail with your certificate also notifies you of the
processing of your personal data by the CA.
You can request that all your information will be shielded. In that case,
your certificate will be revoked and removed from the on-line repository.
We cannot be responsible for leakage of this information if you yourself
continue to present your certificate to third parties.
For information, please contact:
DutchGrid CA
c/o D.L. Groep
P.O. Box 41882
NL 1009 DB Amsterdam, The Netherlands
phone: +31 20 592 2179
fax: +31 20 592 5155
|
or send an electronic mail
to ca@dutchgrid.nl.