Subject: [ietf-privacy] draft-moonesamy-privacy-identifiers-00

From: S Moonesamy <[email-masked]>
Date: Sun, 02 Sep 2012 16:18:45 -0700

Hello,

I would appreciate some feedback about draft-moonesamy-privacy-identifiers-00.

Abstract:
    The Internet provides the ability for information to be spread beyond
    geographical boundaries at the speed of light.  Once information is
    available over the Internet it leaves the private realm.  If the
    information can be used to identify a person it can affect the
    privacy of the individual.  There are cases when it can increase the
    physical risk to the individual or where it can have a negative
    financial impact.  Some types of information can be an embarassment
    to an individual and negatively affect the person's reputation.

    This document discusses about whether Internet Identifiers and
    Session Identifiers can be information about an individual and
    whether consent is necessary.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-moonesamy-privacy-identifiers

Regards,
S. Moonesamy

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 3 Sep 2012 09:39:01 +0300

Hi SM, 

nice writeup. 

A few comments:

* You cite RFC 3365 with regard to what privacy means. RFC 3365 has a very limited view on that topic. 

* PII and personal data: In http://tools.ietf.org/html/draft-iab-privacy-considerations-03 we try to use the term "personal data" and define it as 

      'Any information relating to an identified
      individual or an individual who can be identified, directly or
      indirectly.'

We did that to avoid having refer to back to some laws where the interpretation changes from context to context and also over time. 

* Section 3 and 4: I guess that these two sections have the goal to point out that these identifiers may, depending on the context, allow individuals to be identified. 

* Section 5: The right amount of information

I believe what this section should say is that there are situations where one would like to provided information to the recipient so that a response can be provided and in other cases that's not desired. For example, in today's telephone system you can hide your phone number. Similarly, in SIP there are ways to prevent all information to reach the recipient. 

So, the question isn't really about all or nothing but it is about the ability for the user to decide about the context when they want to reveal information and when they don't. 

There is no doubt that it is difficult to decide about the right amount of information disclosure. But should this be the justification to always reveal everything?  

I agree that there is an asymmetry of power between the user and the entity offering services (which makes the situation worse).

Ciao
Hannes

On Sep 3, 2012, at 2:18 AM, S Moonesamy wrote:

> _______________________________________________
> ietf-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-privacy

---

From: S Moonesamy <[email-masked]>
Date: Mon, 03 Sep 2012 03:33:59 -0700

Hi Hannes,
>A few comments:

Thanks for the feedback.

>a very limited view on that topic.

Yes.

>* PII and personal data: In 
>http://tools.ietf.org/html/draft-iab-privacy-considerations-03 we 
>try to use the term "personal data" and define it as
>
>We did that to avoid having refer to back to some laws where the 
>interpretation changes from context to context and also over time.

There is the "USDC" reference in the draft about a (legal) ruling 
which is an interpretation of the law in one jurisdiction.  I found 
it difficult to develop an argument from there for reason you 
mentioned above.  Some questions which came to mind are how or 
whether PII and "personal data" fit together and which term to use.

>* Section 3 and 4: I guess that these two sections have the goal to 
>point out that these identifiers may, depending on the context, 
>allow individuals to be identified.

Yes.

 From a protocol perspective, the question an author might have to 
answer is whether usage of an identifier triggers privacy 
concerns.  The author might ask whether an identifier can be used.  If I say:

   "Any information relating to an identified individual or an individual
    who can be identified, directly or indirectly."

there may be blank stares.  That's not to say that the definition is 
incorrect or that it can be improved.

>I believe what this section should say is that there are situations 
>where one would like to provided information to the recipient so 
>that a response can be provided and in other cases that's not 
>desired. For example, in today's telephone system you can hide your 
>phone number. Similarly, in SIP there are ways to prevent all 
>information to reach the recipient.

I will see how to fit in the following sentence in Section 5:

   There are situations where one would like to provided information to the
   recipient so that a response can be provided and in other cases that's
   not desired."

I read about several identifiers, including the phone number for SIP, 
when I wrote the draft.  I decided to avoid SIP as I could not find a 
definition similar to "where" or "to whom" which the average person 
might grasp easily.  I'll comment on the telephone system as an 
example.  Let's say that you call me and you hide your phone 
number.  We can still have a conversation; a response can be 
provided.  Now, why can't I hide my IP address when I go to a web 
site?  We both know the argument.  That gets you to: why does the 
Internet work like that?

>So, the question isn't really about all or nothing but it is about 
>the ability for the user to decide about the context when they want 
>to reveal information and when they don't.

That's another way to look at it.  Let me put it differently.  We 
don't ask for consent to reveal the IP address.  That's the 
all-or-nothing proposition for communication over the Internet.  We 
could argue about having a "trusted" middle so that the user does not 
have to reveal the IP address.  We end up putting into question an 
architectural choice on which the Internet is based.  I used the 
following as the argument:

   "There is an implicit assumption that the underlying protocols are
    transmitting the right amount of information needed for the
    protocols to work."

The "amount of information needed for the protocol to work" is 
debatable.  It comes down to a technical choice where we may decide 
that it is necessary to transmit the IP address at a different layer 
to address a performance issue.  The question I might ask the user is:

   Do you want to share your IP address to make your communication faster?

The usual answer would be yes.  I'll reword your comment as follows:

   it is about the ability for the user to decide about the context when
   they want to reveal information and when they don't, in all fairness.

There are too many tangents to that.  There is also the question of 
whether the average person can take an informed decision.

>There is no doubt that it is difficult to decide about the right 
>amount of information disclosure. But should this be the 
>justification to always reveal everything?

That's the hard question.

>I agree that there is an asymmetry of power between the user and the 
>entity offering services (which makes the situation worse).

Instead of answering the previous question I would tackle the matter 
from the asymmetry angle to equalize the two ends.  It would be 
described as an admirable and ludicrous goal.

There is something interesting, for me at least, in RFC 
3365.  Section 6 of that document is about the Danvers doctrine.  The 
IETF community has not taken a position on "must avoid privacy 
concerns in all protocols".  That makes it more difficult to tackle 
the question.

Regards,
S. Moonesamy

---

From: Robin Wilton <[email-masked]>
Date: Mon, 3 Sep 2012 12:05:37 +0100

Hi everyone - 

Just two quick comments on the "how much data should be disclosed" theme…

1 - I think the fact that this is being discussed in detail is very healthy; the fact that there's no easy answer shouldn't deter us from exploring all the nuances and contradictions.

2 - In case it's useful… I can think of at least three instances where I can communicate successfully with a website, without that website knowing my IP address:

A trivial case: when I'm behind a network component that performs Network Address Translation
A more general case: When I'm using TOR (The Onion Router) and my traffic passes through one or more intermediary nodes
A more specific case: when I use privacy-enhanced search tools like IXQuick or DuckDuckGo

Yrs.,
Robin

Robin Wilton
Technical Outreach Director - Identity and Privacy
Internet Society

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

On 3 Sep 2012, at 11:33, S Moonesamy wrote:
> I read about several identifiers, including the phone number for SIP, when I wrote the draft.  I decided to avoid SIP as I could not find a definition similar to "where" or "to whom" which the average person might grasp easily.  I'll comment on the telephone system as an example.  Let's say that you call me and you hide your phone number.  We can still have a conversation; a response can be provided.  Now, why can't I hide my IP address when I go to a web site?  We both know the argument.  That gets you to: why does the Internet work like that?
> 
> That's another way to look at it.  Let me put it differently.  We don't ask for consent to reveal the IP address.  That's the all-or-nothing proposition for communication over the Internet.  We could argue about having a "trusted" middle so that the user does not have to reveal the IP address.  We end up putting into question an architectural choice on which the Internet is based.  I used the following as the argument:
> 
> The "amount of information needed for the protocol to work" is debatable.  It comes down to a technical choice where we may decide that it is necessary to transmit the IP address at a different layer to address a performance issue.  The question I might ask the user is:
> 
> There are too many tangents to that.  There is also the question of whether the average person can take an informed decision.

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 3 Sep 2012 18:17:40 +0300

Hi SM, 

On Sep 3, 2012, at 1:33 PM, S Moonesamy wrote:

> There is the "USDC" reference in the draft about a (legal) ruling which is an interpretation of the law in one jurisdiction.  I found it difficult to develop an argument from there for reason you mentioned above.  Some questions which came to mind are how or whether PII and "personal data" fit together and which term to use.

There are more documents that exist making this statement. 

In the technical community there is no need to convince anyone that an IP address can be used to indirectly identify a person (typically through various database resolution steps). 

As such, I don't think there is a need to cite anything here. 
 
> From a protocol perspective, the question an author might have to answer is whether usage of an identifier triggers privacy concerns.  The author might ask whether an identifier can be used.  If I say:
> 
> there may be blank stares.  That's not to say that the definition is incorrect or that it can be improved.

Interesting. I thought that this is already fairly good. 

> I read about several identifiers, including the phone number for SIP, when I wrote the draft.  I decided to avoid SIP as I could not find a definition similar to "where" or "to whom" which the average person might grasp easily.

The typical reader of an IETF draft is certainly not an average person. In fact it is probably a good thing that they do not read them...

>  I'll comment on the telephone system as an example.  Let's say that you call me and you hide your phone number.  We can still have a conversation; a response can be provided.  Now, why can't I hide my IP address when I go to a web site?  We both know the argument.  That gets you to: why does the Internet work like that?

Well. You can hide your IP address to a certain text. What gets hidden with the IP address depends whether you use systems like Tor, VPNs, NATs, IPv4 / IPv6, etc. 

> That's another way to look at it.  Let me put it differently.  We don't ask for consent to reveal the IP address.  That's the all-or-nothing proposition for communication over the Internet.

You may not ask "Do you want to reveal your IP address? YES / NO". However, what a user may want to do is to get a software it has confidence in that it preserves a certain degree of anonymity. They may, for example, download Tor (or a similar software from other groups).  

Then, these software developers should still be given the option to provide those users who care about their privacy to set the options correctly so that they get what they want (potentially with an impact on the service quality). 

>  We could argue about having a "trusted" middle so that the user does not have to reveal the IP address.  We end up putting into question an architectural choice on which the Internet is based.  I used the following as the argument:

I don't think that we are questioning the Internet architecture as such. 

For example, with onion routing you essentially have various forms of trusted intermediaries. With IPv6 and with MAC address generated interface identifiers you have a much stronger form of re-identification in IETF protocols than you had before and so it is OK to think about the privacy implications. 

>   transmitting the right amount of information needed for the

That's true. The idea is that the open standardization process in the IETF leads to technologies that exercise data minimization because different stakeholder with different interests participate in the standardization activity and therefore avoid excessive and unnecessary sharing of data. This of course assumes that there is some understanding of what privacy is and what goals we may want to accomplish. 

> 
> The "amount of information needed for the protocol to work" is debatable.

Definitely. The contextual nature makes it very difficult for certain protocols to make a clear cut. Then, there are other ways to deal with this situation - as we had been trying to do in Geopriv with user preference indications. 

>  It comes down to a technical choice where we may decide that it is necessary to transmit the IP address at a different layer to address a performance issue.  The question I might ask the user is:
> 

It is true that there is a performance difference when you compare Tor with direct IP communication.  

It really depends on the specific case (the type of privacy threats you want to prevent) whether direct communication is better than not. In the VoIP case, for example, it may be better to have a trusted intermediary to hide your SIP URI etc. but media should not traverse the same infrastructure. 

>  they want to reveal information and when they don't, in all fairness.

For many cases that's correct. 
If the technical basis is not there that allows the user to enable/disable privacy protection as they switch from context to context then it becomes difficult. 

> There are too many tangents to that.  There is also the question of whether the average person can take an informed decision.

Many of the privacy laws a build on the basis that someone is able to make that decision - either it is the end user or someone on his / her behalf. Think about children. Typically, you would assume that their parents make that decision. Then, in many cases we (you and me) also use tools to outsource some of the decision making and to delegate it to people we trust. For example, if you download Ghostery or Adblocker for usage with your browser you decide to rely on specific companies to decide what to block and what not. 

> Instead of answering the previous question I would tackle the matter from the asymmetry angle to equalize the two ends.  It would be described as an admirable and ludicrous goal.
> 
> There is something interesting, for me at least, in RFC 3365.  Section 6 of that document is about the Danvers doctrine.  The IETF community has not taken a position on "must avoid privacy concerns in all protocols".  That makes it more difficult to tackle the question.

That's a good point. We had been discussing this issue while working on the privacy considerations document and we said that we wouldn't mandate anything (particularly since the enforcement would only come through the community and through the IESG - not the IAB). Particularly at the early phase of our work on the privacy guidelines we weren't quite sure whether the level of privacy understanding is actually mature enough. 

However, some time has passed and the privacy guidelines document is stable now. So, it might be interesting to hear what the community thinks. 

Ciao
Hannes

---

From: S Moonesamy <[email-masked]>
Date: Mon, 03 Sep 2012 09:13:56 -0700

Hi Robin,
At 04:05 03-09-2012, Robin Wilton wrote:
>2 - In case it's useful… I can think of at least 
>three instances where I can communicate 
>successfully with a website, without that website knowing my IP address:
>
>A trivial case: when I'm behind a network 
>component that performs Network Address Translation
>A more general case: When I'm using TOR (The 
>Onion Router) and my traffic passes through one or more intermediary nodes
>A more specific case: when I use 
>privacy-enhanced search tools like IXQuick or DuckDuckGo

I'll skip the ToR case to keep matters easy.  The 
two other cases would fit under "trusted" middle 
in my opinion.  That takes us from privacy 
concerns to security concerns.  Some of the 
control (word used loosely) is moved from the 
user to somebody else.  We are indirectly trading privacy for something else.

Regards,
S. Moonesamy

---

From: S Moonesamy <[email-masked]>
Date: Mon, 03 Sep 2012 10:55:03 -0700

Hi Hannes,

Yes.

>In the technical community there is no need to convince anyone that 
>an IP address can be used to indirectly identify a person (typically 
>through various database resolution steps).

Agreed.

The idea is also to show two different viewpoints, i.e. the technical 
side and the non-technical side.

>As such, I don't think there is a need to cite anything here.

Ok.

>Interesting. I thought that this is already fairly good.

I would rate it as good as I don't see any other way.

>The typical reader of an IETF draft is certainly not an average 
>person. In fact it is probably a good thing that they do not read them...

:-)

>Well. You can hide your IP address to a certain text. What gets 
>hidden with the IP address depends whether you use systems like Tor, 
>VPNs, NATs, IPv4 / IPv6, etc.

See my comment to Robin Wilton.

>You may not ask "Do you want to reveal your IP address? YES / NO". 
>However, what a user may want to do is to get a software it has 
>confidence in that it preserves a certain degree of anonymity. They 
>may, for example, download Tor (or a similar software from other groups).

There is a somewhat related message about a question asked to a user 
at 
http://lists.w3.org/Archives/Public/public-tracking/2012Jul/0152.html 
Which question to ask is a question in itself.

>Then, these software developers should still be given the option to 
>provide those users who care about their privacy to set the options 
>correctly so that they get what they want (potentially with an 
>impact on the service quality).

That gets us into an "inevitable choice" discussion.  One of general 
design questions is about considering performance and cost as well as 
functionality.  If the difference in service quality is negligible, 
I'd say that it is a 50/50 choice.  If the difference is noticeable, 
I'd pick the 50/50 choice too as nothing comes for free.  If service 
quality is like degraded mode the software developer does not have to 
worry too much about privacy being part of the design.  It has been 
argued that there is no such thing as a value-neutral 
design.  Decisions, whether it is about security or anything else, 
injects a bias into the equation.

>For example, with onion routing you essentially have various forms 
>of trusted intermediaries. With IPv6 and with MAC address generated 
>interface identifiers you have a much stronger form of 
>re-identification in IETF protocols than you had before and so it is 
>OK to think about the privacy implications.

Ok.

>That's true. The idea is that the open standardization process in 
>the IETF leads to technologies that exercise data minimization 
>because different stakeholder with different interests participate 
>in the standardization activity and therefore avoid excessive and 
>unnecessary sharing of data. This of course assumes that there is 
>some understanding of what privacy is and what goals we may want to accomplish.

The above looks at this from a different angle.  I am not disagreeing 
by the way.  The wall is the asymmetry of power.  We can go around 
that wall with a process where the various interests work together on 
finding a balance.  We could also move that wall around, or rather, 
move the boundaries so that the problem can be less complex.

>Definitely. The contextual nature makes it very difficult for 
>certain protocols to make a clear cut. Then, there are other ways to 
>deal with this situation - as we had been trying to do in Geopriv 
>with user preference indications.

There has been some nice work coming out of Geopriv.

>Many of the privacy laws a build on the basis that someone is able 
>to make that decision - either it is the end user or someone on his 
>/ her behalf. Think about children. Typically, you would assume that 
>their parents make that decision. Then, in many cases we (you and 
>me) also use tools to outsource some of the decision making and to 
>delegate it to people we trust. For example, if you download 
>Ghostery or Adblocker for usage with your browser you decide to rely 
>on specific companies to decide what to block and what not.

Privacy laws vary, i.e. it depends on the culture of the region.  In 
some regions it is left to the individual to make the decision.  In 
some regions society is viewed as having a responsibility in helping 
the individual make the decision.  In some respect, it could be about 
delegation of trust.

>That's a good point. We had been discussing this issue while working 
>on the privacy considerations document and we said that we wouldn't 
>mandate anything (particularly since the enforcement would only come 
>through the community and through the IESG - not the IAB). 
>Particularly at the early phase of our work on the privacy 
>guidelines we weren't quite sure whether the level of privacy 
>understanding is actually mature enough.

Agreed.

>However, some time has passed and the privacy guidelines document is 
>stable now. So, it might be interesting to hear what the community thinks.

Yes.

Regards,
S. Moonesamy

---

From: Robin Wilton <[email-masked]>
Date: Tue, 4 Sep 2012 10:33:13 +0100

This is (again) an excellent airing of the issues, I think. One theme it exposes is the difficulty of balancing two factors:

1 - achieving informed consent, when the target audience doesn't have a mature understanding of the problem, or isn't motivated to act on such understanding as they have;

2 - dealing with stakeholders who react as some did to Microsoft's "DNT by default" decision... i.e. by saying 'if you set a privacy feature to 'on' by default, it is not reliable because it can't be interpreted as an explicit user choice (and hence as an indication if consent).

I like your point about design never being value-neutral... Wondering if there's a sense in which designers can acknowledge that and say "of course not; and these privacy-enhancing design values are legitimately preferable to those privacy-eroding ones"...

Yrs.,
Robin

Sent from my iPod

On 3 Sep 2012, at 18:55, S Moonesamy <[email-masked]> wrote:

> The idea is also to show two different viewpoints, i.e. the technical side and the non-technical side.
> 
> There is a somewhat related message about a question asked to a user at http://lists.w3.org/Archives/Public/public-tracking/2012Jul/0152.html Which question to ask is a question in itself.
> 
> That gets us into an "inevitable choice" discussion.  One of general design questions is about considering performance and cost as well as functionality.  If the difference in service quality is negligible, I'd say that it is a 50/50 choice.  If the difference is noticeable, I'd pick the 50/50 choice too as nothing comes for free.  If service quality is like degraded mode the software developer does not have to worry too much about privacy being part of the design.  It has been argued that there is no such thing as a value-neutral design.  Decisions, whether it is about security or anything else, injects a bias into the equation.
> 
> 
> The above looks at this from a different angle.  I am not disagreeing by the way.  The wall is the asymmetry of power.  We can go around that wall with a process where the various interests work together on finding a balance.  We could also move that wall around, or rather, move the boundaries so that the problem can be less complex.
> 
> Privacy laws vary, i.e. it depends on the culture of the region.  In some regions it is left to the individual to make the decision.  In some regions society is viewed as having a responsibility in helping the individual make the decision.  In some respect, it could be about delegation of trust.
>

---

From: "Bryan McLaughlin (brmclaug)" <[email-masked]>
Date: Tue, 4 Sep 2012 10:32:36 +0000

A few thoughts were stirred by this exchange

That privacy is  not a  physical thing and so it can/will be challenging to educate consumers about what their choice are and mean to them. 

I think the cognitive load on consumers will present  a barrier to  gaining consent that represents what  it purports to be - 'informed'. Therefore a position that starts from least harm  to a user's privacy seems appropriate. So without informed consent a  default action  to not processing the relevant  data would seem correct

Reducing the  cognitive load could be approached initially by reducing the  frequency a  user has to go through  privacy agreements? I hallucinate this would  be helpful in this regard?

How  one creates a personal policy that can be utilised for  such interaction and a framework for using this widely  may in itself be a challenge?.

Bryan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Robin Wilton
Sent: 04 September 2012 10:33
To: S Moonesamy
Cc: [email-masked]
Subject: Re: [ietf-privacy] draft-moonesamy-privacy-identifiers-00

Yrs.,
Robin

Sent from my iPod

---

From: Robin Wilton <[email-masked]>
Date: Tue, 4 Sep 2012 15:08:29 +0100

Really good thoughts, Bryan - and much enlivened by the appearance of the word "hallucinate" in your text. (I'd love to think it was caused by hallucinogens, but probably the more prosaic auto-correct… ;^(  )

Yes, there's a whole set of knotty issues around how to ensure that users are adequately informed, how to capture consent appropriately without inducing 'consent fatigue', and so on.

One suggestion I picked up recently from a design workshop was this (by analogy with other 'user behaviour' challenges such as healthy eating): "what can we do to help users adjust their privacy-related values, so that when presented with a privacy choice, they make better decisions about online behaviour?". (If you replace "privacy" with "dietary" and "online" with "eating", you'll get where this came from…).

What I think is useful about this approach is that it assumes that neither better information (food labelling/privacy icons) nor consent mechanisms (diet is, for these purposes, an entirely discretionary self-motivated activity) are enough to change user behaviour; the vital step is to change the value the user places on their own privacy. 

R

Robin Wilton

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

---

From: S Moonesamy <[email-masked]>
Date: Tue, 04 Sep 2012 09:05:54 -0700

Hi Robin,
At 02:33 04-09-2012, Robin Wilton wrote:
>This is (again) an excellent airing of the issues, I think. One 
>theme it exposes is the difficulty of balancing two factors:
>
>1 - achieving informed consent, when the target audience doesn't 
>have a mature understanding of the problem, or isn't motivated to 
>act on such understanding as they have;

Yes.

>2 - dealing with stakeholders who react as some did to Microsoft's 
>"DNT by default" decision... i.e. by saying 'if you set a privacy 
>feature to 'on' by default, it is not reliable because it can't be 
>interpreted as an explicit user choice (and hence as an indication if consent).

Section 5 of the draft contains the following sentence:

   "If the intention of the person is not clear, he/she may have to
    be asked for consent."

Now, does that mean that DNT can be turned on by default (re: the 
above comment)?  I would base the argument on the following sentence:

   "There is a reasonable expectation that the person will be provided
    with a cautionary notice to which he/she must consent to if the
    information being disclosed may adversely affect the person."

>I like your point about design never being value-neutral... 
>Wondering if there's a sense in which designers can acknowledge that 
>and say "of course not; and these privacy-enhancing design values 
>are legitimately preferable to those privacy-eroding ones"...

The term comes from the "Tussle" paper.  That question came up during 
a presentation within the Security Area.  It was also indirectly 
raised during a discussion on apps-discuss.  The argument I heard is: 
this is how we solved the technical problem; if you have a better 
solution, we would like to hear it.  My take is that the two sides 
are talking past each other.

Regards,
S. Moonesamy

---

From: S Moonesamy <[email-masked]>
Date: Tue, 04 Sep 2012 10:43:15 -0700

Hi Bryan,
At 03:32 04-09-2012, Bryan McLaughlin (brmclaug) wrote:
>I think the cognitive load on consumers will present  a barrier 
>to  gaining consent that represents what  it purports to be - 
>'informed'. Therefore a position that starts from least harm  to a 
>user's privacy seems appropriate. So without informed consent 
>a  default action  to not processing the relevant  data would seem correct

Yes.

>How  one creates a personal policy that can be utilised for  such 
>interaction and a framework for using this widely  may in itself be 
>a challenge?.

Any attempt to solve too many problems at once either ends up not 
solving any of them or creates a complex solution.  That may be the challenge.

Regards,
S. Moonesamy

---

From: Mark Lizar <[email-masked]>
Date: Tue, 4 Sep 2012 23:56:22 +0100

I agree, its great to see some of these issues getting air time. 

>> 1 - achieving informed consent, when the target audience doesn't have a mature understanding of the problem, or isn't motivated to act on such understanding as they have;

I think it would be a mistake to blame the target audience for a lack of mature understanding of the problem.  In fact, I think the audience has an incredible understanding of the problems.  People can understand how much privacy practices impact them physically at the moment (immediately) and respond accordingly.  Is expecting more from people too much to expect?  It  is the integrity of the consent mechanisms at offer, their lack of continuing context or meaningfulness that might be more worthy of responsibility.    

Perhaps achieving informed consent should be looked upon as an iterative process? At the moment we have a one time policy (consent) infrastructure based on (or to facilitate) contracts of adhesion (TOS, EULA etc), in which informed consent is most often no-longer informed as soon as the service (or even the service user) evolves the use of the service.  (online informed consent lacks real meaning)

P3P has a lot to offer in terms of ways to approach the issues of consent, perhaps - a focus on preferences may have been too ambitious and a narrow focus of website policies too limiting. 

Likewise, I wonder if protocol and identifier privacy considerations should (also) be understood in the greater social context of privacy.  Food for thought. 

Mark

---

From: S Moonesamy <[email-masked]>
Date: Wed, 05 Sep 2012 09:59:56 -0700

Hi Mark,
At 15:56 04-09-2012, Mark Lizar wrote:
>I think it would be a mistake to blame the target audience for a 
>lack of mature understanding of the problem.  In fact, I think the 
>audience has an incredible understanding of the problems.  People 
>can understand how much privacy practices impact them physically at 
>the moment (immediately) and respond accordingly.  Is expecting more 
>from people too much to expect?  It  is the integrity of the consent 
>mechanisms at offer, their lack of continuing context or 
>meaningfulness that might be more worthy of responsibility.

The wording could have been improved but then it discourages 
lightweight discussion.  I didn't read it as blaming the target 
audience.  I'll put it another way.  The target audience might not be 
that interested in a discussion about "informed consent" but they do 
have an understanding of what they would not like to see.  People are 
expected to make a split-second decision; i.e. it should be easy for 
the person to make the decision.

>Perhaps achieving informed consent should be looked upon as an 
>iterative process? At the moment we have a one time policy (consent) 
>infrastructure based on (or to facilitate) contracts of adhesion 
>(TOS, EULA etc), in which informed consent is most often no-longer 
>informed as soon as the service (or even the service user) evolves 
>the use of the service.  (online informed consent lacks real meaning)

  "Privacy policies usually end up as disclaimers of liability instead
   of policies aimed at protecting privacy."

A person might not remember all the details of what he/she consented 
to after a while.  It may be easier for the person if the consent 
request is contextual.  That doesn't mean flooding the person with 
questions as it turns into an automated yes (or no).

Regards,
S. Moonesamy

---

From: Mark Lizar <[email-masked]>
Date: Wed, 5 Sep 2012 22:26:29 +0100

> Hi Mark,

Hi,

> The wording could have been improved but then it discourages lightweight discussion.  I didn't read it as blaming the target audience.  I'll put it another way.  The target audience might not be that interested in a discussion about "informed consent" but they do have an understanding of what they would not like to see.  People are expected to make a split-second decision; i.e. it should be easy for the person to make the decision.

Again, this expectation is not only un-realistic but grossly disproportionate to the quality and usability of privacy notices and associated policies online. 

This is a very good point.  People are 'expected' to make split second decisions.  This is one of many unrealistic expectations, especially considering  the content, language, format, and implications of the polices, contracts and terms.  Expectations are high and blatantly unrealistic, considering children, non-english speaking, non-technical, non-legal, disabled, partially literate, busy, emotional people 'need' to use these notices.  In many cases it will never be easy for people to make these decisions.  Frankly, it should be easy to change ones mind, exercise privacy rights and manage informed consent from a personally controlled technical architecture.  Privacy is a public facility, it needs to  be enabled  so that consent can be managed depending on context, without such a facility these policies and notices are not meaningful.  It is in a-context that people have privacy considerations to manage.  It is my opinion that privacy policies and related notices, which we are subjected to today, are still those of the industrial age. (not what should be 'expected' in the information age)

For example,  I can be tracked online and be served custom advertising, real time, yet it is still the law in all jurisdictions that (if a company requires it) I need  to provide a written notice to manage my informed consent, gain access to my data, stop the use of my profile etc. These request can take weeks, even months. 

>  of policies aimed at protecting privacy."

It is a marvel that information technology, social platforms and the like have advanced so incredibly far in the last 5 years, yet privacy policies and their use with Terms Of Service, EULA's, etc have remained largely the same.  

What's more, even though openness is a prinicple found amongst most (all) iterations of privacy principles, privacy policies online are ad-hoc and still very closed.  At the most basic, they have no common technical location, no common format or structure.   Fundamentally, privacy policies should provide clear open and independent access to basic privacy rights that are found in privacy legislated jurisdictions.  Policies should be very open, independently accessible, automatically found, and systematically usable.  Yet they are not. ( a lawyers dream) 

> A person might not remember all the details of what he/she consented to after a while.  It may be easier for the person if the consent request is contextual.  That doesn't mean flooding the person with questions as it turns into an automated yes (or no).

A person should be able to, with one click, withdraw consent from all the services they are connected to.  Privacy should not only be a default, it should be a fundamental pre-requisite. (IMHO) 

Thanks for the opportunity to rant.  
> S. Moonesamy 

Kind Regards,

Mark

---

From: S Moonesamy <[email-masked]>
Date: Wed, 05 Sep 2012 15:49:27 -0700

Hi Mark,
At 14:26 05-09-2012, Mark Lizar wrote:
>Again, this expectation is not only un-realistic but grossly 
>disproportionate to the quality and usability of privacy notices and 
>associated policies online.

Yes.

>This is a very good point.  People are 'expected' to make split 
>second decisions.  This is one of many unrealistic expectations, 
>especially considering  the content, language, format, and 
>implications of the polices, contracts and terms.  Expectations are 
>high and blatantly unrealistic, considering children, non-english 
>speaking, non-technical, non-legal, disabled, partially literate, 
>busy, emotional people 'need' to use these notices.  In many cases 
>it will never be easy for people to make these decisions.  Frankly, it

Yes.

>  should be easy to change ones mind, exercise privacy rights and 
> manage informed consent from a personally controlled technical 
> architecture.  Privacy is a public facility, it

The interesting point in the above is the ability for the person to 
change his/her mind by reversing the consent.  That is difficult to 
do if it is consent about a contractual agreement instead of consent 
to send out an identifier.

>For example,  I can be tracked online and be served custom 
>advertising, real time, yet it is still the law in all jurisdictions 
>that (if a company requires it) I need  to provide a written notice 
>to manage my informed consent, gain access to my data, stop the use 
>of my profile etc. These request can take weeks, even months.

http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data_.html

Regards,
S. Moonesamy

---

From: Mark Lizar <[email-masked]>
Date: Thu, 6 Sep 2012 12:37:28 +0100

On 5 Sep 2012, at 23:49, S Moonesamy <[email-masked]> wrote:

> The interesting point in the above is the ability for the person to change his/her mind by reversing the consent.  That is difficult to do if it is consent about a contractual agreement instead of consent to send out an identifier.

Yes, this is a very interesting point.  Do we have the right to revoke our consent and change our minds?

How valid are these contracts?  What takes precedence privacy rights or badly informed contracts based on marginally informed consent? 

If a company like Google can retroactively combined my data from a whole bunch of disparate services,  utilising 10 years of data aggregation about me, for the sole purpose of profit, without my consent.  How valid is a Google TOU?

Do my privacy rights take a back seat because I use google services? I don't remember clicking an I agree button to make a Google search. 

This point, for me at least,  brings up many questions I don't have answers too.  For instance, In the context of digital identity management, (A.K.A. the use of an identifier) is Google's use of my identifiers, based on this current policy infrastructure of  informed consents, legal? Is informed consent acheived for the use of my real ID that is now a requirement of Google services?

It would also appear that the current technical infrastructure, surrounding informed consent, is built upon match sticks and corporate vapour ware.   Vapour ware fully supported by state access to personal information. Although, it seems quite clear that this does not have to be the case. 

As the old adage goes "The bigger they are, the harder they fall", we just need the technical protocols, architecture and very open notices.  (hint, fight fire with fire)

I still have high hopes for CNIL vs. Google to change this (at least a little)

Mark

---

From: S Moonesamy <[email-masked]>
Date: Thu, 06 Sep 2012 08:15:13 -0700

Hi Mark,
>revoke our consent and change our minds?

That right would not be worth much if I cannot afford a good solicitor. :-)

>How valid are these contracts?  What takes precedence privacy rights 
>or badly informed contracts based on marginally informed consent?

I'll assume that the contract is valid.  Then, what?  I am back to 
the inevitable choice.  What takes precedence is the choices the 
person is given through the design.  The alternative is to resolve 
the above questions.  I doubt that they can be resolved easily.

>If a company like Google can retroactively combined my data from a 
>whole bunch of disparate services,  utilising 10 years of data 
>aggregation about me, for the sole purpose of profit, without my 
>consent.  How valid is a Google TOU?

It's a two-way exchange where I am getting a service for free and the 
service provider is getting something out of it.  I expect that the 
service provider has an economic motivation.  Questions about the 
validity of a terms of use ends up in a legal arena.  It can take 
years to be resolved.  From the above, I'd say that it in unfair bargain.

>Do my privacy rights take a back seat because I use google services? 
>I don't remember clicking an I agree button to make a Google search.

No (see above).

>This point, for me at least,  brings up many questions I don't have 
>answers too.  For instance, In the context of digital identity 
>management, (A.K.A. the use of an identifier) is Google's use of my 
>identifiers, based on this current policy infrastructure 
>of  informed consents, legal? Is informed consent acheived for the 
>use of my real ID that is now a requirement of Google services?

I don't have the answers too.

For what it is worth, the IETF does not work on digital identity 
management.  I suggest taking a look at 
draft-iab-privacy-considerations-03.  Is that document a good start?

Regards,
S. Moonesamy

---

From: Mark Lizar <[email-masked]>
Date: Fri, 7 Sep 2012 16:28:07 +0100

This document is a great start although  I need to read it a few more times before I can comment meaningfully. 

thanks, 

Mark

:-)

On 6 Sep 2012, at 16:15, S Moonesamy <[email-masked]> wrote:

> For what it is worth, the IETF does not work on digital identity management.  I suggest taking a look at draft-iab-privacy-considerations-03.  Is that document a good start?

---

From: Nick Doty <[email-masked]>
Date: Sat, 8 Sep 2012 18:05:59 -0700

Thanks for sharing this draft, it's an interesting read.

A couple of questions kept cropping up for me while reading it. In particular: who is the audience for this draft and what do you intend to communicate to them?

If the intention is to provide an exhaustive listing of identifiers in particular, their legal status and potential privacy concerns, I think there are a few key pieces missing. While IP address cookies (persistent or session-based) and email address are good examples, there may be many other mechanisms for storing identifiers (the "evercookie" is a good example at the Web-level). I also think we should be cognizant of fingerprinting possibilities [0] when considering the privacy implications of identifiers -- user machines and user agents may be identifiable (with the same potential to correlate information about an individual) not because of the presence of a particular number transmitted by their device but because of the unique (or at least uncommon) combination of configuration variables.

I'm also not sure the concept of privacy here is complete. I would personally disagree with emphasizing a dichotomy between the "private realm" and the Internet. Some theorists suggest that privacy is a societal quality rather than individual control, or that the value is in contextual integrity rather than just self-determination. I like the RFC 3365 reference, but would echo Hannes in adding the IAB Privacy Considerations draft [0] as another example. I also think the earlier draft from Morris/Davidson on Public Policy Considerations is worth looking at, it specifically calls out the creation of new persistent unique identifiers as a privacy risk in protocol design [1].

Finally, I suspect we could aggregate more legal questions and decisions if providing some legal context for protocol authors or implementers is the goal. (Offhand, I think there are some interesting positions taken by the US Department of Justice, or distinctions in the Electronic Communications Privacy Act, that would be relevant.) Kasey has suggested doing some of this work within the W3C Privacy Interest Group (PING). 

Thanks for prompting this interesting discussion! I'm hoping the W3C PING will continue to engage on some of these questions regarding advice for protocol authoring and may point them to this work.

Thanks,
Nick

[0] https://panopticlick.eff.org/
[1] http://tools.ietf.org/html/draft-iab-privacy-considerations-03#section-4
[2] http://tools.ietf.org/id/draft-morris-policy-considerations-00.txt

---

From: S Moonesamy <[email-masked]>
Date: Sun, 09 Sep 2012 01:27:07 -0700

Hi Nick,
At 18:05 08-09-2012, Nick Doty wrote:
>A couple of questions kept cropping up for me while reading it. In 
>particular: who is the audience for this draft and what do you 
>intend to communicate to them?

The audience of the draft is the technical community.  The intention 
is to discuss about whether Internet Identifiers and Session 
Identifiers can be information about an individual and whether 
consent is necessary.

>If the intention is to provide an exhaustive listing of identifiers 
>in particular, their legal status and potential privacy concerns, I 
>think there are a few key pieces missing.

I did not provide an exhaustive listing of identifiers as there are, 
in my opinion, missing pieces to reconcile their legal status and 
privacy concerns.  I would say that the potential privacy concerns 
are debatable within the IETF.  If you ask participants whether it 
would be ok for the IETF to publish their email addresses without 
their consent, the answer would be no.  If the average participant is 
designing a protocol which sends out the email address and you point 
out that there are privacy concerns, you might be told that it is not 
a serious concern or it will be pointed out that's how the technical 
work has always been done.

>  While IP address cookies (persistent or session-based) and email 
> address are good examples, there may be many other mechanisms for 
> storing identifiers (the "evercookie" is a good example at the 
> Web-level). I also think we should be cognizant of fingerprinting

Yes.

>  possibilities [0] when considering the privacy implications of 
> identifiers -- user machines and user agents may be identifiable 
> (with the same potential to correlate information about an 
> individual) not because of the presence of a particular number 
> transmitted by their device but because of the unique (or at least 
> uncommon) combination of configuration variables.

I mentioned the fingerprinting during a discussion about a 
specification.  One of the problem, if I may call it that, is that a 
specification generally focuses on use cases for one identifier.  It 
is difficult to make a convincing argument that the potential for 
correlation is also an important consideration.

>I'm also not sure the concept of privacy here is complete. I would 
>personally disagree with emphasizing a dichotomy between the 
>"private realm" and the Internet. Some theorists suggest that 
>privacy is a societal quality rather than individual control, or 
>that the value is in contextual integrity rather than just 
>self-determination. I like the RFC 3365 reference, but would echo 
>Hannes in adding the IAB Privacy Considerations draft [0] as another 
>example. I also think the earlier draft from Morris/Davidson on 
>Public Policy Considerations is worth looking at, it specifically 
>calls out the creation of new persistent unique identifiers as a 
>privacy risk in protocol design [1].

Hannes mentioned that RFC 3365 has a very limited view of the 
topic.  I left out the IAB privacy considerations draft as I was 
looking more as what has been published up to now.  I read the 
earlier draft from Morris and Davidson.  By the way, it seems that 
the approach taken in that draft was dropped in favor of the IAB draft.

There are unique identifiers being created without enough thought to 
the privacy implications.  I avoided the question of the "right to be 
forgotten" as it takes the document into unchartered waters.  I 
emphasized on information leaving the "private realm" as a way to say 
that it is better to keep the cat in the bag instead of trying to put 
it back in.  The issue of whether privacy is a societal quality 
instead of one of individual control is noticeable in the approach 
taken to define personal data (see Section 2).  On an unrelated note, 
there is individualism within the IETF and that can favor a particular view.

>Finally, I suspect we could aggregate more legal questions and 
>decisions if providing some legal context for protocol authors or 
>implementers is the goal. (Offhand, I think there are some 
>interesting positions taken by the US Department of Justice, or 
>distinctions in the Electronic Communications Privacy Act, that 
>would be relevant.) Kasey has suggested doing some of this work 
>within the W3C Privacy Interest Group (PING).

The document starts with some history and it then broaches the legal 
context.  This is more like a "think about it" instead of reaching a 
conclusion on the legal questions and decisions.  If you have any 
references about these positions, I would appreciate if you could 
share them.  It would be worthwhile to do some work in that area to 
get a "worldwide" view of the discussion.

>Thanks for prompting this interesting discussion! I'm hoping the W3C 
>PING will continue to engage on some of these questions regarding 
>advice for protocol authoring and may point them to this work.

The feedback from you and other people on this list has been 
interesting.   In some respect, I toned down the document instead of 
arguing about correlation and several other concerns.  It would have 
been nice to have an analysis of identifiers (e.g. Hannes commented 
about SIP).  Mark Lizar raised some interesting questions.  Bryan 
McLaughlin and Robin Wilton commented on some of the policy 
issues.  There was a presentation about privacy leakage on the 
Internet at IETF77 ( 
www.ietf.org/proceedings/77/slides/plenaryt-5.pdf ).  There wasn't 
that much reaction from the (IETF) audience.

Regards,
S. Moonesamy

---

From: "Bryan McLaughlin (brmclaug)" <[email-masked]>
Date: Sun, 9 Sep 2012 12:13:42 +0000

The intention is to discuss about whether Internet Identifiers and Session Identifiers can be information about an individual and whether consent is necessary

Bmc>

I believe the answer to whether consent is necessary will be "it depends"

Privacy is contextual and so the purpose for which the identifiers are processed will determine the requirement for consent. 

Is the identifier  needed to provide the service or is it processed for "additional" purposes?

Will any processing impact sensitive information? If so additional requirements for consent may be required. 

BTW this may not be as clear cut as it first seems. Location information may indicate - with temporal correlation- religious or medical information. We had a draft and ppt that included this a while back. 

Given that privacy is not an objective binary item I would offer that all identifiers be used with a minimalist approach. So used when needed. Used for a specific purpose. Additional uses are not assumed but must be defined and  explicitly consented to. 

Bryan

---

From: "Bryan McLaughlin (brmclaug)" <[email-masked]>
Date: Sun, 9 Sep 2012 12:16:56 +0000

Oh and I believe in some jurisdictions IP addresses have been determined as personal information. This is determined by authorities other than the IETF and may have geo variation. 

So again whether they are PII " depends" on who and how the question is asked. 

Bryan

Sent from my iPhone

---

From: S Moonesamy <[email-masked]>
Date: Sun, 09 Sep 2012 09:26:41 -0700

Hi Bryan,
>for "additional" purposes?

That discussion alone would generate a long thread on an IETF mailing 
list (e.g. 
http://www.ietf.org/mail-archive/web/apps-discuss/current/msg06907.html )

>Will any processing impact sensitive information? If so additional 
>requirements for consent may be required.

Ok.

>BTW this may not be as clear cut as it first seems. Location 
>information may indicate - with temporal correlation- religious or 
>medical information. We had a draft and ppt that included this a while back.

A reference to the draft and the ppt would be appreciated.

>Given that privacy is not an objective binary item I would offer 
>that all identifiers be used with a minimalist approach. So used 
>when needed. Used for a specific purpose. Additional uses are not 
>assumed but must be defined and  explicitly consented to.

Yes.

Regards,
S. Moonesamy

---

From: "Bryan McLaughlin (brmclaug)" <[email-masked]>
Date: Sun, 9 Sep 2012 17:02:33 +0000

Hi

I hope the below helps

Bryan
>> S. this may not be as clear cut as it first seems. Location information may indicate - with temporal correlation- religious or medical information. We had a draft and ppt that included this a while back.
> 

http://tools.ietf.org/html/draft-brim-mobility-and-privacy-01

http://www.ietf.org/proceedings/79/slides/intarea-3.pdf

---

From: Robin Wilton <[email-masked]>
Date: Mon, 10 Sep 2012 11:08:39 +0100

Hi Bryan - 

I think it's a bit more blurry than that… IP addresses aside, the EU position generally is that information counts as 'personal data' if the entity processing it is in a position to make it so (in other words, my credit card number might not be 'personally identifiable' to you, but it certainly would be to my bank).

The other area of blur is that the lists of 'what counts as personal data' vary from jurisdiction to jurisdiction (even between states in the US, for instance). 

What I don't think the law is even close to coping with yet is the idea that the same piece of data may change, over time, from *not* being personally identifiable to being personally identifiable. An example would be this:

- you visit a retailer's website, and the retailer sets a cookie (but you don't buy anything);
- next time you visit, the retailer checks the cookie: they know you're the same visitor, but they don't know who you are;
- over time, you visit the site many times, but you still don't buy anything. The retailer amasses data about which products you look at,  what search terms brought you to the site, and so on. still, they don't know who you are…
- the day comes when you make a purchase. This time, your visit also becomes associated with a name, a credit card number and a delivery address.

All the data associated with your previous visits is now personally identifiable...

R
 
Robin Wilton

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

---

From: "Bryan McLaughlin (brmclaug)" <[email-masked]>
Date: Mon, 10 Sep 2012 10:58:28 +0000

HI Robin,

I agree it is 'blurry'

My point was that we, the IETF, cannot determine the requirement for consent and the nature of an identifier to be personal data.  The answer will always vary on context and may vary on jurisdiction.

My reason for using the IP address is it's a great example of this very point.

Cheers

Bryan

From: Robin Wilton [mailto:[email-masked]]
Sent: 10 September 2012 11:09
To: Bryan McLaughlin (brmclaug)
Cc: [email-masked]; S Moonesamy
Subject: Re: [ietf-privacy] draft-moonesamy-privacy-identifiers-00

Hi Bryan -

I think it's a bit more blurry than that... IP addresses aside, the EU position generally is that information counts as 'personal data' if the entity processing it is in a position to make it so (in other words, my credit card number might not be 'personally identifiable' to you, but it certainly would be to my bank).

- you visit a retailer's website, and the retailer sets a cookie (but you don't buy anything);
- next time you visit, the retailer checks the cookie: they know you're the same visitor, but they don't know who you are;
- over time, you visit the site many times, but you still don't buy anything. The retailer amasses data about which products you look at,  what search terms brought you to the site, and so on. still, they don't know who you are...
- the day comes when you make a purchase. This time, your visit also becomes associated with a name, a credit card number and a delivery address.

R

Robin Wilton

email: [email-masked]<mailto:[email-masked]>
Phone: +44 705 005 2931
Twitter: @futureidentity

Bryan

Sent from my iPhone

On 9 Sep 2012, at 13:13, "Bryan McLaughlin (brmclaug)" <[email-masked]<mailto:[email-masked]>> wrote:

Bmc>

Bryan

_______________________________________________
ietf-privacy mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ietf-privacy

---

From: Robin Wilton <[email-masked]>
Date: Mon, 10 Sep 2012 12:37:36 +0100

Absolutely

Robin Wilton

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

On 10 Sep 2012, at 11:58, Bryan McLaughlin (brmclaug) wrote:

> I agree it is ’blurry’
> My reason for using the IP address is it’s a great example of this very point.
>  
> Cheers
>  
> Bryan

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 10 Sep 2012 14:47:46 +0300

Could you explain this sentence a bit more? 
I am not sure what the IETF cannot or can do (in your view).

On Sep 10, 2012, at 1:58 PM, Bryan McLaughlin (brmclaug) wrote:

> the IETF, cannot determine the requirement for consent and the nature of an identifier to be personal data.

---

From: Klaas Wierenga <[email-masked]>
Date: Mon, 10 Sep 2012 13:58:10 +0200

On Sep 10, 2012, at 1:47 PM, Hannes Tschofenig <[email-masked]> wrote:

Hannes,

>> the IETF, cannot determine the requirement for consent and the nature of an identifier to be personal data. 

this requirement is a political/legal matter rather than a technical one, i.e. out of scope for the IETF

Klaas

---

From: Robin Wilton <[email-masked]>
Date: Mon, 10 Sep 2012 14:00:01 +0100

It depends slightly on what you mean by "determine"…

The IETF isn't the body that legislates on what the consent requirements are, or what is or isn't personal data… but if those have been decided by the relevant authorities, IETF can ascertain what the decisions specify.

R

Robin Wilton

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

---

From: "Bryan McLaughlin (brmclaug)" <[email-masked]>
Date: Mon, 10 Sep 2012 13:07:58 +0000

Hi Hannes

Klaas' s post reflects my view on what the IETF cannot do. It does not  define what is or is not personal data.

To answer as  my view as to what the IETF can do.

I believe the IETF  can explain to the technical audience the potential privacy  implications of choices they make. It can provide background and guidance  as to the ecosystem that our work will need to be deployed into. It can ensure that those working in the IETF have the resources  to understand both the terminology and the issues of privacy as it pertains to our work.

 The Internet is now in integral part of the economies and culture of the world. That integration is only going to continue as ubiquitous computing occurs in all aspects of life. The IETF can assist in making our work deployable in the wider societal construct in which it must exist.

Does that help?  It seems a little verbose to me  but  I think it provides the answer and the context.

Bryan

-----Original Message-----
From: Klaas Wierenga [mailto:[email-masked]] 
Sent: 10 September 2012 12:58
To: Hannes Tschofenig
Cc: Bryan McLaughlin (brmclaug); [email-masked]; S Moonesamy
Subject: Re: [ietf-privacy] draft-moonesamy-privacy-identifiers-00

Hannes,

Klaas

---

From: Avri Doria <[email-masked]>
Date: Mon, 10 Sep 2012 09:17:59 -0400

Hi,

I think an additional thing the IETF can do is make sure that every item of what is potentially personal data includes the capability of being hidden or deleted without disturbing the rest of a record.  While the condition vary, we know that various legislative frameworks are protecting various elements of personal data (more all the time).  Anything the IETF produces should allow that functionality.  This might even include the basic capability that might be needed to support tiered access to personal data.

avri

---

From: "Bryan McLaughlin (brmclaug)" <[email-masked]>
Date: Mon, 10 Sep 2012 13:20:37 +0000

I meant decide/define/settle/

I would also offer that the IETF's opinion on what a decision specifies would need very careful handling. As we have said  there are valid variations in  context to consider.

Bryan

From: [email-masked] [mailto:[email-masked]] On Behalf Of Robin Wilton
Sent: 10 September 2012 14:00
To: Klaas Wierenga
Cc: [email-masked]; S Moonesamy
Subject: Re: [ietf-privacy] draft-moonesamy-privacy-identifiers-00

It depends slightly on what you mean by "determine"...

The IETF isn't the body that legislates on what the consent requirements are, or what is or isn't personal data... but if those have been decided by the relevant authorities, IETF can ascertain what the decisions specify.

R

Robin Wilton

On Sep 10, 2012, at 1:47 PM, Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:

Hannes,

Klaas