ID Permanence and PPID

Introduction

ID Permanence and Pairwise Identifiers are two different things. 

PPID

The PPID (Pairwise Pseudonymous Identifier) is a concept equivalent to the sub or subject claim in the OIDC (OpenID Connect) specification. This is a normative standard and separate from the CDR standards. See:

• CDS, Security Profile, Claims
• CDS, Normative references

The ID Permanence rules apply to the CDR payloads, so the PPID and ID Permanence rules do not overlap.

The PPID should follow the rules set by OIDC and be unique for each authenticated User.

See:

• CDS, CDR Federation

Sector Identifier URI can be used by the ADR to group a set of domains under common administrative control. Sector Identifier URI relates to the pseudonymous pairwise identifiers (PPID) representing a user  subject.

See:

• CDS, Client registration

ID Permanence

ID Permanence on the other hand pertains to the resource identifiers within sectorial domains defined in the CDR Data Standards.

ID Permanence requirements relate to the consumer, not to the authenticated end user. For one consumer represented by many nominated representatives, the same identifier is issued to the ADR , as the consumer is the same for al lnominated representatives. In the scenario where the individual consumer is the authenticated end user this amounts to only one "sub" value related to the resource identifiers.

Considerations for Nominated Representatives and Secondary Users

Where the authenticated User is a secondary user, the PPID represents that secondary user, not the account owner.

Where the authenticated User is a nominated representative, the PPID represents that nominated representative, not the entity they are representing.

If two nominated representatives set up a consent with the same Software Product, then different PPIDs are issued for each, as the PPID is linked to the authenticated User.

ID Permanence rules apply to resource IDs such as Account ID, or Service Point ID.

The table below indicates how PPID and ID permanence rules vary for individual users, secondary users and nominated representatives.

Consumer type	Individual consumer	Non-individual consumer (entity/organisation)
User type	Account holder Joint account holder Secondary user	Nominated representative
PPID values (‘sub’ or the subject authorising sharing)	Different for each User Different for each 'Sector Identifier' (as defined by OIDC)	Different for each User Different for each 'Sector Identifier' (as defined by OIDC)
ID permanence values (Consumer data, e.g. Payees)	Different for each Consumer Different for each Software Product	Same for each User acting on behalf of the Consumer Different for each Consumer Different for each Software Product
ID permanence values (Account data, e.g. Accounts)	Different for each Consumer Different for each Software Product	Same for each User acting on behalf of the Consumer Different for each Consumer Different for each Software Product

Subsections

See:

• CDS Security Profile
• CDS Scopes and Claims
• CDS Identiers and Subject Types