W3C home > Mailing lists > Public > public-p3p@w3.org > August 2003

Re: new P3P plain English draft - please review by 13 August

From: Lorrie Cranor <lorrie@research.att.com>
Date: Thu, 7 Aug 2003 09:32:44 -0400
Cc: public-p3p@w3.org, garstka@datenschutz-berlin.de
To: lfd-bbg@t-online.de (LDA Brandenburg)
Message-Id: <A094A678-C8DB-11D7-8152-000393DC889A@research.att.com>

Alexander,

Thank you for your comments. I would like to provide you with a few 
clarifications and answer the questions you raised.

First, the document I circulated does not contain any new elements. 
These are the same elements as are found in the P3P 1.0 Recommendation 
that was published in April 2002. The new document simply translates 
the legal definitions in that document into "plain English."

As for the question of why the P3P 1.0 Recommendation offers the 
opportunity for web sites to use elements that describe practices that 
violate data protection laws or fair information practice principles, 
the answer is that these elements exist because they describe practices 
that are in widespread use. By providing these elements we make it easy 
for a P3P user agent to identify sites that have these practices. If we 
did not provide these elements, sites with these practices would not be 
able to use P3P, and thus we would not know anything about their data 
practices without taking the time to read through a lengthy privacy 
statement.

You may be interested in a study my colleagues and I have performed to 
assess the data practices at P3P-enabled web sites (mostly US sites) -- 
see http://lorrie.cranor.org/pubs/icec03.html. We were able to 
determine, for example, that about two-thirds of these sites list their 
data retention policy as 'indefinitely.' We can now easily capture a 
lot of information about the kinds of policies that are being offered. 
This information may be useful in future debates about privacy 
regulation and enforcement.

I think it would be quite useful if short P3P guides were developed for 
particular jurisdictions. For example, a guide to P3P in Germany might 
point out which P3P elements describe practices that are not legal in 
Germany or that are legal only if an opt-out is offered. In addition, 
rule sets could be developed for P3P user agents that would warn users 
or block access to sites that declare practices that violate laws in a 
particular jurisdiction.

Regards,

Lorrie Cranor


On Thursday, August 7, 2003, at 04:31  AM, LDA Brandenburg wrote:

> Lorrie,
>
> thank you for sending the P3P 1.0 element definitions and translations.
> Although I have not participated in the discussions for some time I'd 
> like
> to make several points from the perspective of a lawyer and data 
> protection
> commissioner. I realize that the P3P concept is to offer a broad 
> technical
> platform for the communication of privacy information in machine and 
> human
> readable form.
> However, against the background of the European Data Protection 
> Directive
> the new elemtns and definitions raise some questions:
>
> 1. Why should P3P offer under ACCESS the options of  restricting 
> access to
> contact information and (only) some of the other 
> informationidentifying the
> user or only to contact information or excluding contact information, 
> and
> most importantly, why should P3P provide an element for denying users 
> any
> access to information identifying them ?
>
> 2. Under PURPOSE the elements contain under 'admin' the purpose "To 
> perform
> web site and system administration". Here the questions are: Will
> user-related information be used for this purpose and if so, why should
> this be necessary ?
>
> 3. Still under PURPOSE the element "pseudo-decision" is translated 
> into "To
> make decisions that directly affect you without identifying you, for
> example to display content or ads based on links you clicked on
> previously". In this context it's worth noting that not only German Law
> requires to offer users an opt-out even against profiling under 
> pseudonyms
> but also the International Working Group on Data Protection in
> Telecommunications has supported such an opt-out on a worldwide basis 
> and
> e.g. AOL Europe have accepted it.
>
> 4. Under RETENTION there is an element 'indefinitely'. It is quite 
> obvious
> that indefinite retention would not be acceptable under any data 
> protection
> legislation worldwide. Therefore P3P should not provide an element
> suggesting that there may be such a legal option.
>
>
> Please change my e-mail address  in your address list into
> <dix@lda.brandenburg.de>.
>
> Thanks very much and best wishes,
>
> Alexander Dix
>
>
>
> Lorrie Cranor schrieb:
>
>> The user agent task force of the P3P specification working group
>> received some good feedback on our previous draft translation of the
>> P3P element definitions into plain English. Based on this feedback we
>> have made extensive revisions to our draft. We invite feedback on our
>> revised draft posted at http://www.w3.org/P3P/2003/p3p-translation.htm
>> Please send this feedback to us no later than 13 August 2003.
>>
>> Note that the proposed plain English translations are found in the
>> fifth column of the matrix (in blue). This is the wording that we are
>> recommending that user agent implementers use to display information
>> about P3P policies to end users. We expect to provide translations 
>> into
>> other languages as well. The plain language translations should be
>> consistent with the full definitions given in the P3P specification
>> (shown in the third column of the matrix).
>>
>> Lorrie
>>
>> --
>> Lorrie Faith Cranor - http://lorrie.cranor.org/
>> P3P Specification Working Group Chair - http://www.w3.org/p3p/
>> New book: Web Privacy with P3P - http://p3pbook.com/
>
>
>
> --
> Dr. Alexander Dix, LL.M.
>
> Der Landesbeauftragte
> für den Datenschutz und
> für das Recht auf Akteneinsicht
> Brandenburg
>
> Stahnsdorfer Damm 77
> D-14532 Kleinmachnow
>
> Commissioner for Data Protection
> and Access to Information
> Brandenburg
> Germany
>
> Tel.: ++49/(0)33203/356-0
> Fax:  ++49/(0)33203/356-49
> Internet: http://www.lda.brandenburg.de
>
> Diese Nachricht ist für den oben genannten Empfänger bestimmt.
> Wenn Sie nicht dieser Empfänger sind, lesen, kopieren oder übermitteln
> Sie bitte diese Nachricht nicht, sondern informieren Sie den
> Absender durch eine Antwort-Mail und löschen Sie die Nachricht
> dann in Ihrem System. Vielen Dank.
>
> This message is intended for the individual or entity named above.
> If you are not the intended recipient, please do not read, copy,
> use or disclose this communication to others;
> also please notify the sender by replying to this message, and then
> delete it from your system. Thank you.
>
>
>
Received on Thursday, 7 August 2003 09:30:03 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 8 January 2008 14:13:30 GMT