W3C home > Mailing lists > Public > public-tracking-international@w3.org > January 2013

Re: Doodle poll for meeting, please respond ASAP & DNT:0 action-346 issue-189

From: Peter Cranstone <peter.cranstone@3pmobile.com>
Date: Sun, 13 Jan 2013 17:38:00 +0000
To: Mike O'Neill <michael.oneill@baycloud.com>
CC: Shane Wiley <wileys@yahoo-inc.com>, Rigo Wenning <rigo@w3.org>, "Kimon Zorbas" <vp@iabeurope.eu>, "public-tracking-international@w3.org" <public-tracking-international@w3.org>, DNT <public-tracking@w3.org>, "Peter Swire" <peter@peterswire.net>
Message-ID: <2A61AB2B87BB9342ABE5E22B2CA93C3E15944CE7@mbx022-e1-nj-10.exch022.domain.local>
Hi Mike,

I'd argue that the current exception JavaScript API now becomes even more of a necessity, and of far greater importance, simply because DNT packets MUST now respect international boundaries.


  *   In the US a user agent transmit a privacy intention of DNT=1
     *   Server asks for an exception to use my data - until JavaScript API is built into the browser this is done using HTML and cookies
     *   (No data protection regulation YET, so they don't care about DNT=0 or DNT='')
  *   In Europe a user agent transmits a privacy intention of DNT=0 or DNT=''
     *   Server asks for an exception to use my data - if users says NO then server must de-identify data

Privacy is actually very simple - it's my ability to control the collection, flow and use of my data. The current DNT standard has made that ability 'Binary' - it does NOT distinguish about 'aspects' of my data, it simply makes a blanket overall setting of 'treat ALL my data, and the collection, flow and use of said data' as Private.

Therefore I currently transmit my intention regarding my data. The server responds with a question regarding my intention. Based upon my answer the server reflects that back with a tailored page, AND if necessary (in Europe) de-identify's my data. That's it. All the rest is policy on HOW to handle what you do with my data.

I have YET to see from a technical perspective how the current standard does NOT already support the privacy policy experts. From this point on it's ALL about the exceptions. Sure the techies will have to tweak the JavaScript API a bit, but the framework is already there for someone (the server) based on a policy to ask the user for an exception to their intention.

As soon as I respond with that 'exception' (whatever it is) I have transmitted MY permission e.g. I have agreed to the Terms of Service aka the Policy so from a legal standpoint the content provider is in the clear.



Peter
_________________________
Peter J. Cranstone
CEO.  3PMobile
Boulder, CO  USA


[cid:05F076E5-C316-4120-A289-F8BC07F95735@hsd1.co.comcast.net.]
Improving the Mobile Web Experience

Cell: 720.663.1752
www.3pmobile.com<http://www.3pmobile.com>



On Jan 13, 2013, at 10:04 AM, Mike O'Neill <michael.oneill@baycloud.com<mailto:michael.oneill@baycloud.com>>
 wrote:

Hi Shane, Kimon

My comment was primarily for the GC list to address Rigo’s topic on defining DNT:0 in a EU context. Albrecht’s report is the first time I have seen DNT mentioned in legislation, albeit draft, so I think it is pretty relevant to that.

The new Regulation will replace existing Data Protection EU law and is expected to be passed this year, so I do not think it is all that premature. It is important to take note  if the legal requirements in Europe for consent are diverging from our trajectory.

I put it up on the main list also because the pseudonym concept aligns with what Peter said about de-identification as a DNT issue and I thought it useful for people to be aware of it.

Kimon, it is of course our role to define the details of standard but we have to listen to legislators, who do have a mandate from their electors and reflect their concerns.

Cheers

Mike



From: Shane Wiley [mailto:wileys@yahoo-inc.com]
Sent: 12 January 2013 20:17
To: Mike O'Neill; 'Rigo Wenning'
Cc: public-tracking-international@w3.org<mailto:public-tracking-international@w3.org>; public-tracking@w3.org<mailto:public-tracking@w3.org>
Subject: RE: Doodle poll for meeting, please respond ASAP & DNT:0 action-346 issue-189

Mike,

Don’t you believe it’s a bit premature to integrate elements of an unofficial version of the Data Protection Regulation into the de-identification discussion?  There is still considerable time (in parliamentary terms) for the draft regulation to undergo significant changes prior to voting.

As for the compliance and scope document not aligning with yet to be official EU regulation, this is purposeful and is what the Global Considerations document is meant to address.

- Shane

From: Mike O'Neill [mailto:michael.oneill@baycloud.com]
Sent: Saturday, January 12, 2013 8:52 AM
To: 'Rigo Wenning'
Cc: public-tracking-international@w3.org<mailto:public-tracking-international@w3.org>; public-tracking@w3.org<mailto:public-tracking@w3.org>
Subject: RE: Doodle poll for meeting, please respond ASAP & DNT:0 action-346 issue-189


The European Parliament's Civil Liberties, Justice & Home Affairs committee has published a report on the draft General Data Protection Regulation (DGDPR) which introduces alleviations on data controllers for the use of pseudonymous identifiers. This is similar in concept to the "de-identification" of data for which the meetings in Washington DC and Brussels have been called to discuss. The report also explicitly refers to our W3C Tracking Protection standards.

This report is therefore extremely germane to one of the topics for this group, namely the definition of DNT:0

The new Regulation is expected to come into force this year (although Member States have a further 2 years to enact it) and the views of this crucial committee of democratically elected representatives will inevitably be strongly represented in the final draft. This is important as it refers explicitly to our work and points to the legal context our standard  will ultimately operate under in Europe.

Referring to this report, in the Explanatory Statement paragraph headed Strengthening individuals' rights our standard is referenced:

As the Regulation implements a fundamental right, a limitation of the material scope, particularly as regards the definition of “personal data”, by for instance introducing subjective elements relating to the efforts the data controller should make to identify personal data is rejected. The concept of personal data is further clarified with objective criteria (Article 4(1); Recitals 23 24) . Legitimate concerns regarding specific business models can be addressed without denying individuals their fundamental rights. In this context the rapporteur encourages the pseudonymous and anonymous use of services. For the use of pseudonymous data, there could be alleviations with regard to obligations for the data controller (Articles 4(2)(a), 10), Recital 23).

Consent should remain a cornerstone of the EU approach to data protection, since this is the best way for individuals to control data processing activities. Information to data subjects should be presented in easily comprehensible form, such as by standardised logos or icons (Article 11(2a),(2b)). Technical standards that express a subject’s clear wishesmay be seen as a valid form of providing explicit consent (Articles 7(2a), 23).

This is made more explicit in Amendment 105 to Article 7 of the DGDPR which introduces a new paragraph (2 a):

If the data subject's consent is to be given in the context of the use of information society services where personal data are processed only in the form of pseudonyms, consent may be given by automated means using a technical standard with general validity in the Union in accordance with paragraph 4c, which allows the data subject to clearly express his or her wishes without collecting identification data.

Justification
This allows for the use of standards such as "Do Not Track", combined with an incentive to use only pseudonymous data based as found e.g. in §15 of the German Tele-Media Law. In order to ensure such a standard is in line with this Regulation, it needs to be approved by the Commission. See related amendments to Articles 4(2a), 7(4c) and Recital 23.

Pseudonymous identifiers are defined in Amendment 85 to Article 4 – introducing new text:

'pseudonym' means a unique identifier which is specific to one given context and which does not permit the direct identification of a natural person, but allows the singling out of a data subject;

Note the qualification that pseudonyms are specific “to one given context”. This requirement is repeated in Amendment 117 to Article 10

If the data processed by a controller do not permit the controller to identify or single out a natural person, or consist only of data relating to pseudonyms, the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation.

Justification
Data controllers may use a unique identifier for the same person across different services and contexts, while still not being able to identify a natural person on their basis. Pseudonyms as defined in the amendment to Article 4 are limited to a specific context. The amendment makes clear that the article applies to both cases…

Two points arise from this that we should discuss:
•        The DNT signal is referred to as a Consent signal (for pseudonymous identifiers). This must mean the DNT:0 User Granted Exception. In this context the absence of a DNT signal or if it is set (DNT:1) would mean that consent had not been given and so no unique identifiers should be used, pseudonymous or otherwise.
•        If DNT:0 is indicated, taken as the signaling of explicit user consent by automated means, then pseudonymous identifiers may be used but only in a single context. This must mean that an advertiser, say using their domain origin clickads.com<http://clickads.com>, can only use identifiers within that domain i.e. they must not be shared with other entities, and they must not be associated with other data that could identify the user as a natural person, such as their name, address, email address etc.

The current compliance document is incompatible with both these points because
a.      It assumes that an unset DNT signal is equivalent to DNT:0.
b.      The DNT:0 signal would signify that identifying data can be shared between entities without a need for further explicit informed consent

Cheers,

Mike

-----Original Message-----
From: Rigo Wenning [mailto:rigo@w3.org]
Sent: 08 January 2013 18:54
To: David Wainberg
Cc: public-tracking-international@w3.org<mailto:public-tracking-international@w3.org>
Subject: Re: Doodle poll for meeting, please respond ASAP

David, Chris,

the topics in this task force are very limited. I enumerated them in the kick-off email:

http://lists.w3.org/Archives/Public/public-tracking-international/2012Nov/0000.html

1/ Definition of DNT:0 (which will more or less define what one can do) 2/ TPE additions 3/ Which form should the EU How-to take (Note, best practice, document for webplatform.org<http://webplatform.org>)

Those are my main topics. But I'm open to a debate about more urgent things.

I think this is not interesting for people who only want to make sure the things created do not interfere with their solutions. Because the entire work will be brought back to the entire group anyway for decision. But then, it will be bundled and the ability to influence in detail will be less. After all nobody wants to negotiate all the stuff twice..

But if you're really interested in the solutions found for a regulated market, I think you should closely monitor. We also hope to be able to provide an audio link. But the times will be inconvenient.

Does that answer your questions?

-- Rigo

On Tuesday 08 January 2013 10:21:44 David Wainberg wrote:
> Hi Rigo,
>
> Can you state the agenda for the meeting? I know there have been
> conversations, and I think some thoughts have been tossed around, but
> as we get to making concrete plans it would be helpful to know the
> goals and agenda for the meeting. Thanks much.
>
> Best,
>
> David
>
> On 1/8/13 10:16 AM, Rigo Wenning wrote:
> > Hi all,
> >
> > this is to select the meeting days. We can not go earlier than 21
> > Feb, because people have to prepare for traveling. From that I
> > created the doodle poll for a meeting in Berlin/Germany:
> >
> > http://www.doodle.com/4nxv7trzb34xdvqk
> >
> > Known conferences so far:
> > 6-8 March IAPP Washington DC
> >
> > Please fill out the poll ASAP so we can prepare the invitation and
> > the logistics in time.
> >
> > Best,
> >
> > Rigo




Signature Logo.jpeg
(image/jpeg attachment: Signature_Logo.jpeg)

Received on Sunday, 13 January 2013 17:38:31 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Sunday, 13 January 2013 17:38:31 GMT