...
The identifier MUST be designed such that its value does not directly or indirectly reveal the identity of an individual’s identityindividual.
The identifier MUST be constructed as a locally unique value followed by “@” and a scope. The combination of the locally unique value and scope uniquely identifies the subject within the federation.
...
The identifier MUST be designed such that its value does not directly or indirectly reveal the identity of an individual’s identityindividual.
The identifier MUST be generated in a manner that prevents the subject from being correlated across different Relying Parties.
...