RE: P3P Future Work: Items 2, 5, and 6

My comments are provided below. We generally agree with and endorse these
three efforts and would be willing to help.
 
Dan Schutzer
212-559-1876
schutzerd@citigroup.com


-----Original Message-----
From: Bzwit@aol.com [mailto:Bzwit@aol.com]
Sent: Friday, December 13, 2002 5:31 PM
To: public-p3p-ws@w3.org
Subject: P3P Future Work: Items 2, 5, and 6


P3P Future Work Item 2: Indication of Agent Status, Multiple Domains Owned
by One Company, etc.

Purpose: 
Many companies have sites on multiple domains and, with the current
implementations of P3P, have had a very difficult time implementing P3P and
compact policies on all its sites. When content is shared between domains,
significant difficulties have been encountered with both P3P and compact
policies from different sites being inconsistent with the practices of the
site using the content or cookies from the second domain being blocked even
when the same company owns both sites. In addition, some companies are
acting as agents for another company and are simply following the
contracting company's privacy policy. 

There is no mechanism in the specification to allow a site to handle content
sharing between domains or indicate that one site is acting as the agent for
another. (HINT is sometimes incapable of fully expressing the relationship
between sites.) To encourage adoption of P3P, a mechanism or mechanisms are
required to permit a site to easily share content without an unduly
complicated P3P policy or compact policies and to indicate that one site is
the agent for another site.

Scope: 
Work on the issues discussed above could, without excluding other ideas,
center on the following:

1. Along with the work being done to review other aspects of compact
policies, review the efficiencies, if any, associated with compact policies
and even the need for compact policies given the experience of implementing
P3P so far; and

2. Creating a mechanism to allow a site to declare other sites as
first-party sites, i.e., that they are all owned by the same company and
have the same or similar privacy practices or are acting for another site as
an agent and are bound by the other sites privacy policies, in both P3P and
compact policies; and

Resources:
There is no known work already on this topic. However, extensive experience
exists in the private sector with implementing P3P on sites that share
significant amounts of content. These experiences could be leveraged to
identify problems and potential solutions.

Time Frame:
The issues here should be relatively easy to resolve. It should be possible
to reach consensus on a mechanism to accomplish the last objective above
within the timeframe for version 1.1 of the specification. Review of compact
policies might take longer to complete. (See P3P Future Work Item 4.)



----------------------------------------------------------------------------
----




P3P Future Work Item 5: User Agent Behavior

Purpose: 
Developers have begun to implement P3P in new versions of their products,
mostly web browsers. As with the first version of most products, these
efforts have received mixed reviews from users and site operators.

The current implementations have interfered with the functionality of some
sites, confused users, and implement different standards[Dan Schutzer]  in
different ways . These implementations of P3P have required the developer to
make certain decisions regarding what privacy practices to review and what
to do if that particular privacy practice is enabled at a site, e.g., does
the browser look for cookies that store personally identifiable information
on the user's computer and then block them or just downgrade them.

Sites have been enabling P3P, particularly compact policies, and have had
difficulties implementing P3P and maintaining functionality in the new user
agents. Now functionality is not only limited by the rendering engine of a
browser, for example, but also whether the browser will block cookies based
on some particular privacy practice.

More consistency between user agents in how P3P is implemented would be
helpful to users as their experience on one user agent would be transferable
to another and to sites so that they could build the site and develop one
consistent privacy policy.[Dan Schutzer]  This will be especially important
as P3P gets implemented by agents other than one's browser. 

Scope: 
Work on the issues discussed above could, without excluding other ideas,
center on the following:

1. Determining whether some basic recommendations are needed for
implementing P3P in user agents; (NOTE: The word "recommendation" is used
here only to describe the scope of this effort. The form, e.g., whether
recommendations, suggestions, guidelines, a separate specification, or even
just a white paper, is an unresolved question.)

2. Reviewing the experiences of users and site operators with the currently
available user agents to determine what areas should be addressed in this
conversation; and

3. Prepare recommendations for developers of user agents to follow when
appropriate in implementing P3P.

Resources:
There has been significant work already done on this topic. Resources are
available from developers as well[Dan Schutzer]   as governmental regulators
and NGOs. In addition, there are probably significant resources available in
academia to assist in this effort. Despite the significant resources
available, it is expected that reaching consensus on any recommendations
would take a substantial amount of work and time. However, no formal
recommendations may be required, the discussion itself may be useful to
developers of users agents as well as site operators.

Time Frame:
The issues here will probably be relatively hard to resolve and the
timeframe for any formal recommendations would be significant. However,
given previous discussions, it is doubtful that any recommendations coming
from this effort would be included in the P3P specification. It would likely
be in a separate document instead and allow this work and other work on the
specification itself to proceed on different schedules.[Dan Schutzer] There
are already some work in the spec that could be extended to provide more
consistency in user agent implementation. I'd like to see at least some
effort to get this addressed in the next version of the spec, with more
details to be provided in the separate document discussed above. 




----------------------------------------------------------------------------
----




P3P Future Work Item 6: Description of the Contours of P3P

Purpose: 
While many sites have adopted P3P, adoption has been slower than hoped for
because companies are unsure of their liabilities for statements made in P3P
and compact policies given the limitations of the technology at this time.
No one is suggesting that sites are not liable or should be given immunity
for mistakes or misrepresentations in their P3P statements. However,
everyone recognizes that P3P does not allow a site to describe every nuance
of its privacy practices and that the specification is a work in progress.
The purpose of this item is to clarify the current state of the
specification as to what privacy practices can and cannot be expressed in
the lexicon of P3P.

Scope: 
The work is limited to descriptive text only. The text would more
explicatedly describe what privacy practices can and cannot be described in
a P3P or compact policy and other limitations of the technology. For
instance, P3P with its limited vocabulary cannot be expected to represent
every nuance of a site's privacy policy. The additional text may also
recognize, without rendering P3P irrelevant, that the human readable privacy
policy is the authoritative statement of a site's privacy policies.

Resources:
Minimal resources required to complete this item. A draft of proposed
language could be drafted by a small group of P3P Specification Working
Group members and circulated broadly for comment by the remaining members.

Time Frame:
Based on the discussion at the P3P Workshop, there appeared to be some
common ground on this issue and it should be relatively easy to resolve. It
should be possible to reach consensus on language within the timeframe for
version 1.1 of the specification.

Brian ( AOL IM <aol://9293:bzwit/>  | AOL Mail <mailto: bzwit/a> )




-----------------------------------------------------------------
Brian J. Zwit, Director, Integrity Assurance
America Online, Inc.
* (703) 265-6232 * AIM: bzwit * Internet * bzwit@aol.com <mailto:
bzwit@aol.com> 
----- AOL Confidential Information -----