Consent Management for IoT APIs #299
Closed
FabrizioMoggio
started this conversation in
General
Replies: 1 comment 3 replies
-
|
The requirement is "where personal data is processed by the API and users can exercise their rights through mechanisms such as opt-in and/or opt-out, the use of three-legged access tokens is mandatory". For the IoT use case, I would imagine that the MSISDNs are not considered to be personal data, and hence there is no opt-in requirement or opt-out right. In that case, 2-legged access tokens are fine. Of course, any implementation that was using MSISDNs to identify the devices would need to ensure that the API did indeed only work for such IoT devices, and not for any MSISDN that the API consumer submits. |
Beta Was this translation helpful? Give feedback.
3 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
In the IoT Network Optimization API (https://github.com/camaraproject/IoTNetworkOptimization) we have the following use case:
Use case: enablement of IoT Network features (e.g. power saving) for a fleet of devices, typically not associated to a person (M2M).
I don't see User Consent applicable in this scenario so, even if phone numbers are input parameters (and this usually impose using 3Legs) I think this APIs should use 2Legs.
Please consider: camaraproject/IoTNetworkOptimization#10
Beta Was this translation helpful? Give feedback.
All reactions