[ARCHIVE] Clarification regarding Profile Scope

Archived 2023.08.11. Content moved to Guidance on Profile Scope

Questions below relate to Profile scope changes introduced in DP216, Profile scope support, which was accepted and forms part of CDS v1.17.0.

Question

As per the Consumer Data Standards (CDS)  v1.17.0, an Accredited Data Recipient (ADR) may request either the OIDC profile, or one or multiple claims without using the profile scope. The OIDC profile includes all the claims listed in the 'name' data cluster.

Consider a scenario where the profile scope has been requested by an ADR in the original consent. In a consent amendment flow the ADR removes the profile scope and include some claims in the 'name' data cluster.

In this case, is a Data Holder (DH) required to pre-select this data cluster or is the cluster presented as not selected?

Answer

Yes, the DH is required to pre-select this data cluster. From a data representation perspective, the profile scope and the claims that OIDC defines as included in the scope should be treated as synonymous.

Question

Where additional information is required to be displayed, is it mandatory to show claims that have been modified in a consent amendment flow or can a generic notification can be used to notify the change in claims. 

Answer

The participant should provide additional guidance at their discretion. However, the participant must present the data cluster language according to the CDS. 

Question

As per the change made to CDS v1.17.0 version on profile scope, is a DH required to display both 'Name' and 'Contact Details' data clusters if only the profile scope is being sent by the ADR.

Answer

The standards have been clarified to indicate that the contact language is required only if the additional contact claims are included in the consent.