Subject: RE: Contractual Rules again

From: "Rosen, Brian" <[email-masked]>
Date: Thu, 17 Jul 2003 06:24:10 -0400

I expect that most often it will be the service provider's standard
contract.  The point of a uri is to be able to confirm that
the agreed rules apply.  I wouldn't want to limit this.
For that matter, a contract is not exclusive (unless it says
that it is); you may be able to use the rules defined in
the object, and in addition have some kind of subtlety not
expressible in the rules.

I'd certainly be agreeable to stating that this is for a contract,
i.e. something both parties willingly entered into prior to sending
the information.  That would obviate the problem you are worried 
about (a statement of limits that the other party doesn't necessarily 
agree to).  I think that limits the use, but it also limits the abuse.

You certainly could imagine systems that refuse to accept or
provide location when it was subject to some written contract
it didn't know about.  You could also imagine systems that
popped up panels that required you to accept the rules 
before proceeding. 

Brian

> -----Original Message-----
> From: Henning Schulzrinne [mailto:[email-masked]]
> Sent: Thursday, July 17, 2003 5:13 AM
> To: Rosen, Brian
> Cc: [email-masked]
> Subject: Re: Contractual Rules again
> 
> 
> I would like to better understand who would send this reference to a 
> contract. I can't imagine that if I send my location to my service 
> provider that they will accept an object with a contract, as 
> mine will 
> likely say "if this goes to anybody I don't like, you will be 
> liable for 
> $1mio. and the first-born child of the CEO".
> 
> I can see this for distribution of information to individual 
> recipients, 
> but this again raises the issue of what the contract can say. 
> If I can't 
> read the contract on my pager, I don't want to incur unlimited 
> liability. Thus, the automatic rules have to offer 'safe 
> harbor' - if I 
> don't violate them, I can't be sued.
> 
> Rosen, Brian wrote:
> 
> > I find myself repeating a request for contractual privacy rules.
> > It occurs again in draft-morris-geopriv-core-02.txt
> > 
> > I think this should be refined.  I think there are three elements:
> > 1. A notice to the observer that the lo is subject to a written
> > set of restrictions on the use of the object.  This is a
> > binary element and is the only required element
> > 2. An (optional) uri which contains at least a facsimile of the
> > written rules. This is the preferred way to provide the rules
> > 3. A freeform text element which could either actually contain
> > the rule, or provide another reference to the rules
> > which for some reason are not available on the web.
> > 
> > Brian
> 
>

---

From: Henning Schulzrinne <[email-masked]>
Date: Thu, 17 Jul 2003 07:20:01 -0400

My concern with any external reference is

- what happens if it can't be accessed

- what happens if the content changes either 'naturally' or maliciously, 
before the time of retention expires?

These are both solvable, but it needs to be clearly specified.