Subject: [ietf-privacy] Is there an official working definition for Privacy Online?

From: Fred Yeboah <[email-masked]>
Date: Thu, 16 Apr 2015 14:51:48 +0000

Dear all,
Can some help me with the official working definition of Online Privacy 
as used by IETF-Privacy group?
Thank you

-- 
Best regards
Fred Yeboah

---

From: Ted Hardie <[email-masked]>
Date: Thu, 16 Apr 2015 12:05:26 -0700

Hi Fred,

RFC 6973 (found, among other places at:
http://www.rfc-editor.org/rfc/rfc6973.txt) has an extensive terminology
section and review of the issues.  You may find it a useful place to start.

regards,

Ted Hardie

On Thu, Apr 16, 2015 at 7:51 AM, Fred Yeboah <[email-masked]> wrote:

>  Dear all,
> Can some help me with the official working definition of Online Privacy as
> used by IETF-Privacy group?
> Thank you
>
> --
> Best regards
> Fred Yeboah
>
>
> _______________________________________________
> ietf-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-privacy
>
>

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Thu, 16 Apr 2015 11:19:57 -0400

> as used by IETF-Privacy group?

This is a nuanced question without a short answer.

You might approach it by reading https://tools.ietf.org/html/rfc6973,
which outlines some of the ways that people within the IETF think about
privacy.

        --dkg

---

From: Dave Crocker <[email-masked]>
Date: Thu, 16 Apr 2015 15:07:26 -0700

> section and review of the issues.  You may find it a useful place to start.

Except that it does not define privacy.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Robin Wilton <[email-masked]>
Date: Thu, 16 Apr 2015 22:33:02 +0000

I don't know of an official IETF finite on, but this is the one the Internet Society has been using for a while, and I think it's still good:

http://www.internetsociety.org/blog/2013/12/language-privacy

Robin Wilton

Technical Outreach Director - Identity and Privacy

---

From: Rob van Eijk <[email-masked]>
Date: Fri, 17 Apr 2015 06:18:42 +0000

There is no official IETF working definition for privacy. It is a 
complex term. I agree with Ted that the term is nicely introduced in RFC 
6973 [url: https://tools.ietf.org/html/rfc6973]. Looking for a 
definition for privacy will open a whole range of e.g., scholarly 
definitions. Privacy as control [Westin], is one of them. [url: 
https://en.wikipedia.org/wiki/Privacy] is actually not a bad primer.

regards::Rob

Robin Wilton schreef op 2015-04-16 22:33:
> I don't know of an official IETF finite on, but this is the one the
> Internet Society has been using for a while, and I think it's still
> good:
>

---

From: Fred Yeboah <[email-masked]>
Date: Fri, 17 Apr 2015 13:25:42 +0000

Dear all,
Thank you very much for your various contribution, advice and lead to 
documents to address my curiosity on what is Online privacy. While there 
seems not to be an official working definition of Online Privacy, how is 
this phenomenon measured currently online. Under what circumstance do we 
say someone's Online privacy is breached. Can Online privacy be same as 
the right to privacy?

On 04/17/2015 06:18 AM, Rob van Eijk wrote:
> complex term. I agree with Ted that the term is nicely introduced in 
> RFC 6973 [url: https://tools.ietf.org/html/rfc6973]. Looking for a 

-- 
Best regards
Fred Yeboah

---

From: Dave Crocker <[email-masked]>
Date: Fri, 17 Apr 2015 07:47:05 -0700

> http://www.internetsociety.org/blog/2013/12/language-privacy

Thanks. That definition looks quite reasonable.

Now to get the IETF to settle on it...

Note that the definition isn't all that complicated, but does cover the
essential issue that discussions of privacy usually entail, specifically
control over disclosure.  Also note that that is quite a useful
distinction from "confidentiality" and its usual embodiment of "encryption".

Failure to adopt a working definition for a key construct tends to
reflect a failure to build a solid, shared foundation for the topic of
interest.

d/

---

From: Josh Howlett <[email-masked]>
Date: Fri, 17 Apr 2015 15:11:54 +0000

> essential issue that discussions of privacy usually entail, specifically control
> over disclosure.  Also note that that is quite a useful distinction from
> "confidentiality" and its usual embodiment of "encryption".

+1

My simplistic rule of thumb is that confidentiality relates to the opaqueness of information communicated /between/ subjects, whereas privacy relates to the disclosure of information by one subject /about/ another.

Josh.

Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Fri, 17 Apr 2015 11:20:57 -0400

On Fri 2015-04-17 11:11:54 -0400, Josh Howlett wrote:
> My simplistic rule of thumb is that confidentiality relates to the
> opaqueness of information communicated /between/ subjects, whereas
> privacy relates to the disclosure of information by one subject
> /about/ another.

Privacy also relates to the disclosure of information by one subject
about itself.

      --dkg

---

From: Dave Crocker <[email-masked]>
Date: Fri, 17 Apr 2015 09:13:52 -0700

On 4/17/2015 8:11 AM, Josh Howlett wrote:
> privacy relates to the disclosure of information by one subject /about/ another.

Sorry, no.  That's overly narrow.

The portion of text stating "...and with expectations regarding the
context and scope of sharing." might be taken to imply what you've
stated, but the ISOC text has broader meaning than that.  That is, the
'about another' is a subset of what it covers.

Simple example:

Suppose I do not want my date of birth freely distribute.  I want to
control that information.  It's 'about' me.  It's not 'about' your
distributing it.  It's about your /seeing/ it.  From me (or anyone else).

This translates into "privacy relates to controlling disclosure of
information about a person or organization."  Then add the
scope-of-control portion.

d/

---

From: "Christian Huitema" <[email-masked]>
Date: Fri, 17 Apr 2015 21:08:12 -0700

On Friday, April 17, 2015, at 9:14 AM, Dave Crocker wrote
> ...

There is indeed some fuzziness in the definition of privacy. I like the
analysis in this Pew Research Center study on "Public Perceptions of Privacy
and Security in the Post-Snowden Era:"
http://www.pewinternet.org/2014/11/12/public-privacy-perceptions/. I think
they do a good job relating threats to privacy and threats to personal
security. To quote: "Beyond the frequency of individual words, when
responses are grouped into themes, the largest block of answers ties to
concepts of security, safety, and protection. For many others, notions of
secrecy and keeping things 'hidden' are top of mind when thinking about
privacy."

-- Christian Huitema

---

From: "taxakis" <[email-masked]>
Date: Sun, 19 Apr 2015 01:59:07 +0200

Probably for some unnoticed, check out:
http://plato.stanford.edu/entries/it-privacy/

-- Bertil

   There is indeed some fuzziness in the definition of privacy. I like the
   analysis in this Pew Research Center study on "Public Perceptions of
   Privacy and Security in the Post-Snowden Era:"
   http://www.pewinternet.org/2014/11/12/public-privacy-perceptions/. I
think
   they do a good job relating threats to privacy and threats to personal
   security. To quote: "Beyond the frequency of individual words, when
   responses are grouped into themes, the largest block of answers ties to
   concepts of security, safety, and protection. For many others, notions of
   secrecy and keeping things 'hidden' are top of mind when thinking about
   privacy."
   
   -- Christian Huitema

---

From: Fred Yeboah <[email-masked]>
Date: Mon, 20 Apr 2015 15:15:54 +0000

Can Privacy online be defined as "the control an individual or 
organization has over data or information provided either mandatory or 
voluntary relating to accessing any online service(s) with an 
understanding that individual/organization does not infringes on other 
users privacy online".

-- 
Best regards
Fred Yeboah

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Thu, 23 Apr 2015 15:52:09 -0400

(not necessarily in response to Christian)

> secrecy and keeping things 'hidden' are top of mind when thinking about

There is emerging academic work (not published yet, so I won't cite)
that discusses privacy as what philosophers call an "essentially
contested concept." The idea being that for some class of ideas and
concepts -- art, justice, freedom, etc. -- there is no single
definition and, instead, that the struggle around what they mean
defines them.

I realize that's some pretty non-technical and abstract thinking, but
for many folks (like some of us here) that have been involved for
decades in academic/industry/civil society kvetching on privacy and
defining it, the realization that the lack of a definition may in
itself define the thing is pretty important and profound.

I was a postdoc under NYU professor Helen Nissenbaum a while back and
at least in the academic privacy community, her notion of "contextual
integrity" is perhaps the biggest "definitional" thinking we've seen
in a decade or so. She has written a book on it, but I suggest anyone
interested read the following shorter article that hits the high
points:

http://www.amacad.org/publications/daedalus/11_fall_nissenbaum.pdf

best, Joe

-- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
[email-masked]
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871