Unlinkability

What the clause says

The system should prevent an observer from linking two age assurance transactions to the same person when the service does not need to.

What it supplies to a comparison

Unlinkability is tested by comparing identifiers across transactions. A comparison that only reads the privacy policy misses a stable identifier in a token.

Evidence to keep

• The identifier inventory for a transaction.
• The cross-transaction test showing whether a stable value is reused.

What the evidence looks like

For 7.1.3, the first artefact is The identifier inventory for a transaction.. The second is The cross-transaction test showing whether a stable value is reused.. If 7.1.3 has no first artefact, the practice is unproven at 7.1.3, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. Does a relying party or an intermediary see a stable identifier?
2. Is the linkability needed for the service, and is that need recorded?

How it connects to the draft

Unlinkability belongs to 7 privacy objectives, and it gives the analysis one fixed point: Unlinkability is tested by comparing identifiers across transactions. A comparison that only reads the privacy policy misses a stable identifier in a . A comparison that cannot place a result against 7.1.3 is measuring something the framework has not defined, and the report should say so.

In the register, 7.1.3 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.