A few weeks ago, during our IAWG call, we agreed to amend 63B#1900 as shown below:
63B#1900 | | | The CSP SHALL revoke promptly the binding of authenticators to the Subject's online identity, unless prohibited by any legal instrument, and give notice of such to the Subject, when any one of the following occurs: |
63B#1900 | a) | | the Subject's online identity ceases to exist; OR |
63B#1900 | b) | | the Subject requests revocation; OR |
63B#1900 | c) | | the CSP determines that the Subject no longer meets its eligibility requirements; OR |
|
|
|
|
This time the baby went out with the bath water. Whilst I find the revision to the main clause to be acceptable (well, a minor tweak to the grammar, see below), we should NOT have eliminated sub-clause d). This clause actually requires the CSP to respond to a legal instrument requiring that they revoke, so must be retained. The introduced clause should be taken to be a broad reference to ANY legal prohibition, whereas d) applies to an express order or instruction. I therefore suggest that the change should be only as shown below (purple text just to be clear about differentiation):
63B#1900 | | | The CSP SHALL revoke promptly the binding of authenticators to the Subject's online identity and, unless prohibited by any legal instrument, |
63B#1900 | a) | | the Subject's online identity ceases to exist; OR |
63B#1900 | b) | | the Subject requests revocation; OR |
63B#1900 | c) | | the CSP determines that the Subject no longer meets its eligibility requirements; OR |
63B#1900 | d) | | the CSP is obligated to do so in response to a legal instrument. |
Lessons? Maybe always allow a little breathing time between what look like good changes but may deserve more consideration before pouring the concrete (not sure what that has to do with babies and bathwater, but … subject for discussion this week?)
Richard G. WILSHER
CEO & Founder, Zygma Inc.
www.Zygma.biz
+1 714 797 9942