Subject: [ietf-privacy] Re Privacy Considerations

From: [email-masked]
Date: Thu, 5 Jan 2012 02:06:34 +0100 (CET)

Re: Privacy Considerations for Internet Protocols
draft-iab-privacy-considerations-01.txt

Dear Alissa, Hannes, Bernard, Jon and John,

Thank you.

This is an excellent and clear draft with beautifully crafted guidelines.

As foreshadowed with Alissa, a couple of comments and questions for your consideration:

Comments regarding the introduction

1/ Some people seem to use the term “privacy” when they mean “confidentiality”, so I wonder whether it might be helpful to add some text after “Privacy as a legal concept is understood differently in different jurisdictions” such as:

With regard to data, often it is a concept applied to ‘personal data’ generally defined as information relating to an identified or identifiable individual (or similar) or to particular defined categories of data.

2/ The draft describes the “basic principles of national application” in the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data as “Fair Information Practices (FIPs)”. However, it may be more accurate to describe them as “privacy principles”. 

It may be also useful to mention that the OECD Guidelines seek to balance two goals – protection of privacy and the free flow of personal data across borders. 

3/ The concept of “Privacy by Design” is, like privacy, understood differently in (and within) different jurisdictions. Perhaps it would be useful to clarify that the PbD is one such framework. 

Comments regarding guidelines

4/ The first question regarding trade-offs may be practically difficult for protocol designers unless they are provided with a description or some other guidance as to what privacy means in the Internet context. Given the difficulty in defining privacy either legally or technically, perhaps the trade-off questions could be broken down into a series of questions that tease out different aspects of privacy. For example, using the terms from the guidelines,:

Does the protocol trade-off data minimization with usability?
Does the protocol trade-off user participation with efficiency?
… etc.

5/ Regarding the question in 4.2b - “How identifiable is this information?” – Is this asking how easily the information can be identified or how easily the information can be linked to an individual and/or device? (Note: this question is also relevant to 4.2e)

6/ Regarding the questions in 4.2c - In theory, even a non-unique fingerprint may in some circumstances be sufficient when combined with other information to identify an individual and/or device.

7/ Regarding the questions in 4.2d – Would it be useful to also ask “Does the protocol allow implementers or users to collect and/or correlate identifiers?”?

Best regards,
Christine