11. Privacy Considerations

11. Privacy Considerations

When the client is being granted access to a protected resource containing personal data, both the client and the authorization server need to adhere to Privacy Principles. "Privacy Considerations for Internet Protocols" [RFC6973] gives excellent guidance on the enhancement of protocol design and implementation. The provisions listed in it should be followed.

Most of the provisions would apply to "The OAuth 2.0 Authorization Framework" [RFC6749] and "The OAuth 2.0 Authorization Framework: Bearer Token Usage" [RFC6750] and are not specific to this specification. In what follows, only the provisions specific to this specification are noted.

See 11.1. Collection Limitation and 11.2. Disclosure Limitation.