...
The value MUST be persistent, stable over time, and globally unique, and MUST NOT be reassigned to another subject.
The identifier MUST be designed such that its value does not directly or indirectly reveal the identity of an individual.
The identifier MUST be constructed as a locally unique value followed by “@” and a scope. The combination of the locally unique value and scope uniquely identifies the subject within the federation.
...
The value MUST be persistent and stable over time for a given subject–Relying Party pair, and MUST NOT be reassigned to another subject.
The identifier MUST be designed such that its value does not directly or indirectly reveal the identity of an individual.
The identifier MUST be generated in a manner that prevents the subject from being correlated across different Relying Parties.
...