The date of birth is not disclosed

What the clause says

The system should avoid disclosing a person's date of birth to the relying party. The age attribute can be delivered without the underlying date.

What it supplies to a comparison

A comparison should record what the relying party receives. A system that passes the whole document fails this objective even when the age result is correct.

Evidence to keep

• The data fields delivered to the relying party.
• The test showing the date of birth is not in the delivered payload.

What the evidence looks like

For 7.1.1, the first artefact is The data fields delivered to the relying party.. The second is The test showing the date of birth is not in the delivered payload.. If 7.1.1 has no first artefact, the practice is unproven at 7.1.1, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. Does the relying party receive the date of birth anywhere in the flow?
2. Is the minimum data rule stated in the practice statement?

How it connects to the draft

The date of birth is not disclosed belongs to 7 privacy objectives, and it gives the analysis one fixed point: A comparison should record what the relying party receives. A system that passes the whole document fails this objective even when the age result is c. A comparison that cannot place a result against 7.1.1 is measuring something the framework has not defined, and the report should say so.

In the register, 7.1.1 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.