ACTION-785: Check the personalization section for specific parts that seem to imply combination of personal information with usage patterns

Well, since adjourned early, I had some time :-)
 
 
BP2 revisted for this action
 
This now applies to section 3.1 (formerly 4.1, as listed in ACTION-784)
 

regarding...


3.1.1.1 What it means


If a service relies on user entered personalization information (e.g.
application preferences, personal details) that information should be
retained in order to avoid the need to re-enter it the next time a user
visits the site.

 

Here we should simply delete ", personal details" or change it into
"personal preferences".

Personal data could be construed to mean name, address, phone number
etc. which is not allowed to be associated with usage patterns and other
information like it.

 

 

regarding...


3.1.2.2 How to do it


The simplest way to do this is to associate personalization information
with a given user identity and obtain their login credentials directly
on first access.

 

Here we need to separate between what is often called "passive
personalization" and "active personalization".

Passive personalization tracks usage patterns and tends to assing a
profile to a user that fits to his behavior, but is not combined with
personal information

Active personalization requires the agreement of the user to store and
use certain personal information (not sure on what can be used then, but
at least a login).
For the above this means that we have to allude to the needed permission
by the user.

 

-- Kai