Subject: Using P3P technologies to express privacy preferences

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 16 Aug 2002 09:58:57 +0200

Sometimes ago, there was a discussion ("Data Collection Requirements")
about using P3P:

http://www.cafax.se/ietf-provreg/maillist/2001-07/msg00002.html

But there was no real conclusion expect that the protocol should
provide a way for an individual contact to indicate its privacy
preferences.

Was there any work done after that? I assume that a P3P policy file
could be included in the XML stream (although the registry policy does
not change so often, registrars do not need to read it each time) and,
more important, that an APPEL file
<URL:http://www.w3.org/TR/P3P-preferences/> could be included in the
<contact:create> element to carry to the registry the privacy
preferences of a contact. Anyone interested to follow this idea?

---

From: Patrick <[email-masked]>
Date: Fri, 16 Aug 2002 10:23:00 +0200

> not change so often, registrars do not need to read it each time) and,

<dcp> ?
§2.3 of draft-ietf-provreg-epp-06.txt

> preferences of a contact. Anyone interested to follow this idea?

I am not sure that P3P exactly as is will nicely fit in EPP, since
P3P was designed for websites.

In fact by reading §1.1 of your reference, I fail to understand how
to fit that in EPP. Since the EPP client is not the final user (the
one you specify in contact:create) nor run by the final user, 
what options are there ?
(as quoted: 4.The agent fetches the policy ... and determines what
action to take)

Also, it would probably be a huge overhead to specify things
everytime in contact:create
I guess that Registrars will adopt only one behavior with maybe some
exceptions. 

Other than that I am interested.

Patrick.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 16 Aug 2002 10:36:02 +0200

On Fri, Aug 16, 2002 at 10:23:00AM +0200,
 Patrick <[email-masked]> wrote 

> P3P was designed for websites.

Yes, this is an issue to study. But I believe (although we'll be sure
only when an actual P3P policy file for a registry will be published)
that it does not bend P3P too much to use it for a registry. Besides,
there is no alternative. I'm not in the mood to write an EPP extension
for that.
 
> one you specify in contact:create) nor run by the final user, 

The registrar should relay the preferences of the contact. For
instance, if the registrant uses a Web form, it will be queried for
his choices and they will be translated in APPEL and sent to the
registry in the EPP XML stream. An alternative is to use the APPEL
directly from the browser export system (I'm not aware of any Web
browser which supports it yet). 

> I guess that Registrars will adopt only one behavior with maybe some

I'm not sure (IANAL) that it will be legal. The european law seems to
mandate that at least some stuff must be available to an opt-out
choice.