Subject: Re: [ietf-privacy] Privacy Terminology: What are useful terms?

From: [email-masked]
Date: Tue, 12 Jul 2011 05:30:48 +0200 (CEST)

Hi all.

Joining the conversation a little late. 

PRIVACY

As other contributors have noted, there is no universally agreed definition of "privacy". Individual perspectives on privacy vary depending on culture, economics, society, politics, religion, history, experience, education, etc. which makes it very difficult to "encode" in legal frameworks.

Indeed, neither the OECD Guidelines Governing the Protection of Privacy and Transborder Data Flows of Personal Data nor the APEC Privacy Framework define "privacy".

In the context of this discussion, it is also worth noting that generally only individuals have a right or entitlement to privacy – corporations and other legal entities do not. (Corporations etc. may have other rights, e.g. commercial confidentiality.) There is also no legal concept of collective or group privacy. Further, an individual’s right or entitlement to privacy usually ceases when he or she dies.

However, as to definitions of "privacy", our friend, Trent, spotted this definition in the OECD "Glossary of Statistical Terms" (see http://stats.oecd.org/glossary/detail.asp?ID=6959):

"Privacy is a concept that applies to data subjects while confidentiality applies to data.

The concept is defined as follows: "It is the status accorded to data which has been agreed upon between the person or organisation furnishing the data and the organisation receiving it and which describes the degree of protection which will be provided."."

Perhaps this could be a useful starting point for further discussion.

(In any case, in the IETF context, we are concerned with online privacy, rather than privacy at large.)

PERSONAL DATA/PERSONAL INFORMATION

Rather than defining "privacy", most privacy/data protection laws, principles and guidelines confine their scope by defining "personal data/personal information" or by specifying particular classes of data.

For example, the OECD Guidelines Governing the Protection of Privacy and Transborder Data Flows of Personal Data define personal data and the APEC Privacy Framework defines personal information as "any information relating to an identified or identifiable individual".

Perhaps as an additional question, how would the IETF translate that legal definition into terminology for Internet protocols and standards? 

Regards,
Christine