Subject: Re: [ietf-privacy] draft-moonesamy-privacy-identifiers-00

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Sat, 8 Sep 2012 23:04:45 +0300

Regarding the statement that the IETF does not work on identity management: of course we do. The latest example is the ABFAB working group

Sent from my Windows Phone

-----Original Message-----
From: ext S Moonesamy
Sent: 9/6/2012 6:52 PM
To: Mark Lizar
Cc: [email-masked]
Subject: Re: [ietf-privacy] draft-moonesamy-privacy-identifiers-00

Hi Mark,
At 04:37 06-09-2012, Mark Lizar wrote:
>Yes, this is a very interesting point.  Do we have the right to 
>revoke our consent and change our minds?

That right would not be worth much if I cannot afford a good solicitor. :-)

>How valid are these contracts?  What takes precedence privacy rights 
>or badly informed contracts based on marginally informed consent?

I'll assume that the contract is valid.  Then, what?  I am back to 
the inevitable choice.  What takes precedence is the choices the 
person is given through the design.  The alternative is to resolve 
the above questions.  I doubt that they can be resolved easily.

>If a company like Google can retroactively combined my data from a 
>whole bunch of disparate services,  utilising 10 years of data 
>aggregation about me, for the sole purpose of profit, without my 
>consent.  How valid is a Google TOU?

It's a two-way exchange where I am getting a service for free and the 
service provider is getting something out of it.  I expect that the 
service provider has an economic motivation.  Questions about the 
validity of a terms of use ends up in a legal arena.  It can take 
years to be resolved.  From the above, I'd say that it in unfair bargain.

>Do my privacy rights take a back seat because I use google services? 
>I don't remember clicking an I agree button to make a Google search.

No (see above).

>This point, for me at least,  brings up many questions I don't have 
>answers too.  For instance, In the context of digital identity 
>management, (A.K.A. the use of an identifier) is Google's use of my 
>identifiers, based on this current policy infrastructure 
>of  informed consents, legal? Is informed consent acheived for the 
>use of my real ID that is now a requirement of Google services?

I don't have the answers too.

For what it is worth, the IETF does not work on digital identity 
management.  I suggest taking a look at 
draft-iab-privacy-considerations-03.  Is that document a good start?

Regards,
S. Moonesamy 

_______________________________________________
ietf-privacy mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf-privacy

---

From: S Moonesamy <[email-masked]>
Date: Sat, 08 Sep 2012 14:09:44 -0700

Hi Hannes,
At 13:04 08-09-2012, Tschofenig, Hannes (NSN - FI/Espoo) wrote:
>Regarding the statement that the IETF does not work on identity 
>management: of course we do. The latest example is the ABFAB working group

Thanks for the correction.

I wanted to avoid a discussion about the case involving Formula One 
and a search engine.

Regards,
S. Moonesamy