You will see the Consent screen every time you want to access a new service through SURFconext or when either your personal information (called attributes) have changed since the last time you logged in to an existing service or the service asks for different attributes since the last time you logged in. Unless your institution decided to disable this screen for a specific service.
There are 2 types of this screen:
- An informational screen which informs you about which (personal) information (called attributes) are being forwarded from your institution via SURFconext to the service. You can still prevent the attributes from being sent to the Service Provider but this screen is not formally consent.
- A consent screen, which not only informs you but also provides you with a formal choice to permit or deny the release of personal information towards the service. Please note that by denying the release of attributes, you will not be able to use the service through SURFconext.
Your institution is responsible for selecting which version of the screen (or no screen at all) you get to see for each service.
The remainder of this page explains these screens in more detail.
When do you see the Consent screen
The Consent screen appears at least once for every service you want to access through SURFconext, unless your institution decided to disable the screen for a specific service. After having agreed to pass on your attributes to a service, this choice is remembered for that particular service. You will only see the screen again again (for that particular service) if 1 of the following situations arises:
- The service asks for a different set of attributes since the last time consent was provided (e.g. before the service didn't ask for your email address and now it does).
- The contents of (one of) your attributes has changed (e.g. you have a new email address).
Privacy
SURFconext finds (your) privacy very important. An important way to protect your privacy is to make you aware which (personal) information is being used by a particular service. Also, SURFconext offers you a choice to either accept or reject the release of information to each service.
If you want to see for which services you provided consent, please have a look at the Profile page.
Two types of consent
Please note that there are two different types of consent.
- Type 1 (discussed above) is to specifically ask you for permission to pass through your attributes (from your institution) to the service you want to use. You will encounter this type most often.
- Type 2 is about passing through information about your group memberships. Some services use SURFconext's group ability, to view which groups (or teams) you belong to. This specific Consent screen allows you to share your group information with the service.
Withdrawing consent
Once given, it is not possible to withdraw consent to a specific service.
Once you have given consent to pass on your attributes to a service, the service usually saves this information in it own local databases. By doing this, the service does not have to ask your institution for, for example, your email address, every time you want to use the service.
Neither SURFconext nor your institution has access to the systems and databases of the service. So there is no way for them to make sure your personal attributes are being removed after you have withdrawn consent. Therefore, withdrawing consent is pretty useless, since the service already made a local copy of your personal attributes.
If you'd like to withdraw your consent for a specific service, please contact them directly. On the SURFconext Profile page, you can see which services you've accessed through SURFconext.