SWITCHaai Interfederation Access Declaration

Organization Name:

Université de Genève
Rue du Général Dufour 24
CH - 1204 Genève

For this, we warrant towards SWITCH, Werdstrasse 2, CH-8021 Zurich (hereafter SWITCH), international intermediary regarding the SWITCHaai Federation, to respect and being bound to the following:

1. Data Protection

Having noted the relevant legal documents such as

• this Interfederation Access Declaration,
• the Service Regulations for Services by SWITCH, https://www.switch.ch/uni/terms
• the SWITCHaai Service Description, https://www.switch.ch/aai/docs/SWITCHaai_Service_Description.pdf
• the Templates on Legal Issues for SWITCHaai, https://www.switch.ch/aai/legaltemplates
• the GÉANT Data Protection Code of Conduct (CoCo), http://www.geant.net/uri/dataprotection-code-of-conduct/ we wish to gain AAI Interfederation Access.

We acknowledge that the data exchanged between the AAI Interfederation Access Participants qualify as personal data and, therefore, must comply with the Swiss Federal Act on Data Protection (DPA, SR 235.1), with additional Cantonal Data Protection Law and art. 7 of the Data Protection Directive 95/46/EC of the European Union of 24 October 1995. In our Identity Provider we have already configured or will configure the technical module for user consent (as suggested in the "Templates on Legal issues for SWITCHaai") in order to comply with the obligations imposed by those regulations, such as requesting user consent of the End User, informing End Users before using the services about the respective attributes to be released to the Service Provider to whom an End User requests access, giving them revocation rights regarding global consent, adequately protect attributes and anonymising them when they are no longer necessary. For our Service Providers, we will only request those attributes from other AAI Interfederation Participants that are strictly necessary for the specific service explicitly requested by the End User and we will adhere to the "GÉANT Data Protection Code of Conduct (for Service Providers in EU/EEA)" and implement a privacy statement along the CoCo-criterias.

2. Liability

We acknowledge that we are liable for the actions of our End Users according to the "Service Regulations for Services by SWITCH" and the "SWITCHaai Service Description".