- From: Frederick Hirsch via cvs-syncmail <cvsmail@w3.org>
- Date: Wed, 20 Jul 2011 07:48:58 +0000
- To: public-dap-commits@w3.org
Update of /sources/public/2009/dap/privacy-practices
In directory hutz:/tmp/cvs-serv12775
Modified Files:
FPWD.html
Log Message:
html version
Index: FPWD.html
===================================================================
RCS file: /sources/public/2009/dap/privacy-practices/FPWD.html,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -d -r1.2 -r1.3
--- FPWD.html 20 Jul 2011 07:46:48 -0000 1.2
+++ FPWD.html 20 Jul 2011 07:48:56 -0000 1.3
@@ -1,63 +1,50 @@
-<!DOCTYPE html>
-<html>
- <head>
+<!DOCTYPE html PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN' 'http://www.w3.org/TR/html4/loose.dtd'>
+<html lang="en" dir="ltr">
+<head>
<title>Web Application Privacy Best Practices</title>
- <meta http-equiv='Content-Type' content='text/html;charset=utf-8' />
- <script src='../ReSpec.js/js/respec.js' class='remove'></script>
- <script class='remove'>
- var respecConfig = {
- specStatus: "FPWD-NOTE",
- shortName: "app-privacy-bp",
- editors: [
- { name: "Frederick Hirsch", company: "Nokia", companyURL:
- "http://www.nokia.com/" },
- ],
- // publishDate: "2010-06-29",
- // previousPublishDate: "1977-03-15",
- edDraftURI: "http://dev.w3.org/2009/dap/privacy-practices/",
- // lcEnd: "2009-08-05",
- noRecTrack: true,
- };
- </script>
- <script src='../common/config.js' class='remove'></script>
+ <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
+
+
+
- </head>
- <body>
- <section id='abstract'>
+ <link href="http://www.w3.org/StyleSheets/TR/W3C-WD" rel="stylesheet" type="text/css" charset="utf-8"></head><body style="display: inherit; "><div class="head"><p><a href="http://www.w3.org/"><img width="72" height="48" src="http://www.w3.org/Icons/w3c_home" alt="W3C"></a></p><h1 class="title" id="title">Web Application Privacy Best Practices</h1><h2 id="w3c-working-draft-20-july-2011">W3C Working Draft 20 July 2011</h2><dl><dt>This version:</dt><dd><a href="http://www.w3.org/TR/2011/WD-app-privacy-bp-20110720/">http://www.w3.org/TR/2011/WD-app-privacy-bp-20110720/</a></dd><dt>Latest published version:</dt><dd><a href="http://www.w3.org/TR/app-privacy-bp/">http://www.w3.org/TR/app-privacy-bp/</a></dd><dt>Latest editor's draft:</dt><dd><a href="http://dev.w3.org/2009/dap/privacy-practices/">http://dev.w3.org/2009/dap/privacy-practices/</a></dd><dt>Editor:</dt><dd><span>Frederick Hirsch</span>, <a href="http://www.nokia.com/">Nokia</a></dd>
+</dl><p class="copyright"><a href="http://www.w3.org/Consortium/Legal/ipr-notice#Copyright">Copyright</a> © 2011 <a href="http://www.w3.org/"><acronym title="World Wide Web Consortium">W3C</acronym></a><sup>®</sup> (<a href="http://www.csail.mit.edu/"><acronym title="Massachusetts Institute of Technology">MIT</acronym></a>, <a href="http://www.ercim.eu/"><acronym title="European Research Consortium for Informatics and Mathematics">ERCIM</acronym></a>, <a href="http://www.keio.ac.jp/">Keio</a>), All Rights Reserved. W3C <a href="http://www.w3.org/Consortium/Legal/ipr-notice#Legal_Disclaimer">liability</a>, <a href="http://www.w3.org/Consortium/Legal/ipr-notice#W3C_Trademarks">trademark</a> and <a href="http://www.w3.org/Consortium/Legal/copyright-documents">document use</a> rules apply.</p><hr></div>
+ <div id="abstract" class="introductory section"><h2>Abstract</h2>
This document describes privacy best practices for web
applications, including those that might use device
APIs.
- </section> <!-- abstract -->
-
- <section id='sotd'>
+ </div><div id="sotd" class="introductory section"><h2>Status of This Document</h2><p><em>This section describes the status of this document at the time of its publication. Other documents may supersede this document. A list of current W3C publications and the latest revision of this technical report can be found in the <a href="http://www.w3.org/TR/">W3C technical reports index</a> at http://www.w3.org/TR/.</em></p>
This document is expected to be further updated based on both Working
Group input and public comments. The Working Group anticipates to
eventually publish a stabilized version of this document as a W3C
Working Group Note.
- </section>
+ <p>This document was published by the <a href="http://www.w3.org/2009/dap/">Device APIs and Policy Working Group</a> as a First Public Working Draft. If you wish to make comments regarding this document, please send them to <a href="mailto:public-device-apis@w3.org">public-device-apis@w3.org</a> (<a href="mailto:public-device-apis-request@w3.org?subject=subscribe">subscribe</a>, <a href="http://lists.w3.org/Archives/Public/public-device-apis/">archives</a>). All feedback is welcome.</p><p>Publication as a Working Draft does not imply endorsement by the W3C Membership. This is a draft document and may be updated, replaced or obsoleted by other documents at any time. It is inappropriate to cite this document as other than work in progress.</p><p>This document was produced by a group operating under the <a href="http://www.w3.org/Consortium/Patent-Policy-20040205/">5 February 2004 W3C Patent Policy</a>. The group does not expect this document to become a W3C Recommendation. W3C maintains a <a href="http:/www.w3.org/2004/01/pp-impl/43696/status" rel="disclosure">public list of any patent disclosures</a> made in connection with the deliverables of the group; that page also includes instructions for disclosing a patent. An individual who has actual knowledge of a patent which the individual believes contains <a href="http://www.w3.org/Consortium/Patent-Policy-20040205/#def-essential">Essential Claim(s)</a> must disclose the information in accordance with <a href="http://www.w3.org/Consortium/Patent-Policy-20040205/#sec-Disclosure">section 6 of the W3C Patent Policy</a>.</p></div><div id="toc" class="section"><h2 class="introductory">Table of Contents</h2><ul class="toc"><li class="tocline"><a href="#introduction" class="tocxref"><span class="secno">1. </span>Introduction</a></li><li class="tocline"><a href="#privacybydesign" class="tocxref"><span class="secno">2. </span>Privacy By Design</a></li><li class="tocline"><a href="#usercentric" class="tocxref"><span class="secno">3. </span>User Centric Design</a></li<li class="tocline"><a href="#data-minimization" class="tocxref"><span class="secno">4. </span>Minimize collection and
+ transmission of personal data</a><ul class="toc"></ul></li><li class="tocline"><a href="#data-confidentiality" class="tocxref"><span class="secno">5. </span>Maintain the confidentiality of personal data</a></li><li class="tocline"><a href="#bp-summary" class="tocxref"><span class="secno">6. </span>Best Practices Summary</a></li><li class="tocline"><a href="#references" class="tocxref"><span class="secno">A. </span>References</a><ul class="toc"><li class="tocline"><a href="#normative-references" class="tocxref"><span class="secno">A.1 </span>Normative references</a></li><li class="tocline"><a href="#informative-references" class="tocxref"><span class="secno">A.2 </span>Informative references</a></li></ul></li></ul></div> <!-- abstract -->
- <section id='introduction'>
- <h2>Introduction</h2>
+
+
+ <div id="introduction" class="section">
+ <!--OddPage--><h2><span class="secno">1. </span>Introduction</h2>
<p>
This document outlines good privacy practices for web
applications, including those that might use
device APIs. This continues the work on privacy best practices
- in section 3.3.1 on "User Awareness and Control" Mobile Web Application Best Practices [[MWABP]]. It does not repeat the privacy principles and
+ in section 3.3.1 on "User Awareness and Control" Mobile Web Application Best Practices [<cite><a class="bibref" rel="biblioentry" href="#bib-MWABP">MWABP</a></cite>]. It does not repeat the privacy principles and
requirements documented in the Device API Privacy Requirements Note
- [[DAP-PRIVACY-REQS]] which should also be consulted.
+ [<cite><a class="bibref" rel="biblioentry" href="#bib-DAP-PRIVACY-REQS">DAP-PRIVACY-REQS</a></cite>] which should also be consulted.
</p>
- </section>
- <section id="privacybydesign">
- <h3>Privacy By Design</h3>
+ </div>
+ <div id="privacybydesign" class="section">
+ <!--OddPage--><h2><span class="secno">2. </span>Privacy By Design</h2>
<p>
The principles of "Privacy by Design" should be reflected in the
web application design and implementation, including the use
of device APIs.
These are enumerated below and in more detail in the reference
- [[PRIVACY-BY-DESIGN]].</p>
+ [<cite><a class="bibref" rel="biblioentry" href="#bib-PRIVACY-BY-DESIGN">PRIVACY-BY-DESIGN</a></cite>].</p>
<div class="practice">
<p>
- <span id="bp-privacy-by-design" class="practicelab">Follow "Privacy By Design" principles</span></p>
+ <span id="bp-privacy-by-design" class="practicelab">Best Practice 1: Follow "Privacy By Design" principles</span></p>
<p class="practicedesc">
Proactively consider privacy, make preservation of
privacy the default, including privacy in a
@@ -76,14 +63,13 @@
<li>Respect for User Privacy — Keep it User-Centric</li>
</ol>
</div>
- </section>
- <section id="usercentric">
- <h2>User Centric Design</h2>
+ </div>
+ <div id="usercentric" class="section">
+ <!--OddPage--><h2><span class="secno">3. </span>User Centric Design</h2>
<p>Privacy should be user centric, giving the user understanding
and control over use of their personal data.</p>
<div class="practice">
- <p><span id="bp-user-driven"
- class="practicelab">Enable the user to make informed decisions about
+ <p><span id="bp-user-driven" class="practicelab">Best Practice 2: Enable the user to make informed decisions about
sharing their personal information with a service.
</span></p>
<p class="practicedesc">
@@ -96,8 +82,7 @@
</p>
</div>
<div class="practice">
- <p><span id="bp-choices-in-context"
- class="practicelab">Enable the user to make decisions at the
+ <p><span id="bp-choices-in-context" class="practicelab">Best Practice 3: Enable the user to make decisions at the
appropriate time with the correct contextual information.
</span></p>
<p class="practicedesc">
@@ -130,8 +115,7 @@
<!-- through action.</p> -->
</div>
<div class="practice">
- <p><span id="bp-sp-choices"
- class="practicelab">When learning user privacy
+ <p><span id="bp-sp-choices" class="practicelab">Best Practice 4: When learning user privacy
decisions and providing defaults, allow the user to easily view and
change these previous decisions.
</span></p>
@@ -146,8 +130,7 @@
</p>
</div>
<div class="practice">
- <p><span id="bp-usability"
- class="practicelab">Focus on usability and avoid needless prompting.
+ <p><span id="bp-usability" class="practicelab">Best Practice 5: Focus on usability and avoid needless prompting.
</span></p>
<p class="practicedesc">
Focus on usability should improve a service as well as
@@ -156,12 +139,11 @@
harm the user experience and many users will not know how to
respond to prompts, choosing a choice that enables them to
continue their work
- [[GEOLOCATION-PRIVACY]].
+ [<cite><a class="bibref" rel="biblioentry" href="#bib-GEOLOCATION-PRIVACY">GEOLOCATION-PRIVACY</a></cite>].
</p>
</div>
<div class="practice">
- <p><span id="bp-clarity"
- class="practicelab">Be clear and
+ <p><span id="bp-clarity" class="practicelab">Best Practice 6: Be clear and
transparent to users regarding
potential privacy concerns.
</span></p>
@@ -173,8 +155,7 @@
</p>
</div>
<div class="practice">
- <p><span id="bp-clarify-one-shot-or-repeated"
- class="practicelab">Be clear as to whether information is
+ <p><span id="bp-clarify-one-shot-or-repeated" class="practicelab">Best Practice 7: Be clear as to whether information is
needed on a one-time basis or is necessary for a period of
time.
</span></p>
@@ -183,17 +164,16 @@
for a single use or will be retained and have an impact over time.
</p>
</div>
- </section>
- <section id="data-minimization">
- <h2>Minimize collection and
+ </div>
+ <div id="data-minimization" class="section">
+ <!--OddPage--><h2><span class="secno">4. </span>Minimize collection and
transmission of personal data</h2>
- <section id="minimization-considerations">
+ <div id="minimization-considerations" class="section">
<p>Review the data and how it is structured and used, minimizing
the amount and detail of data required to provide a service.
</p>
<div class="practice">
- <p><span id="bp-data-granularity"
- class="practicelab">Request the minimum number of data
+ <p><span id="bp-data-granularity" class="practicelab">Best Practice 8: Request the minimum number of data
items at the
minimum level of detail needed to provide a service.</span></p>
<p class="practicedesc">
@@ -207,8 +187,7 @@
</p>
</div>
<div class="practice">
- <p><span id="bp-data-retention"
- class="practicelab">
+ <p><span id="bp-data-retention" class="practicelab">Best Practice 9:
Retain the minimum amount of data at the minimum level of detail for
the minimum amount of time needed.
Consider potential misuses of retained data and
@@ -223,13 +202,12 @@
</p>
</div>
- </section>
- </section>
- <section id="data-confidentiality">
- <h2>Maintain the confidentiality of personal data</h2>
+ </div>
+ </div>
+ <div id="data-confidentiality" class="section">
+ <!--OddPage--><h2><span class="secno">5. </span>Maintain the confidentiality of personal data</h2>
<div class="practice">
- <p><span id="bp-use-https"
- class="practicelab">
+ <p><span id="bp-use-https" class="practicelab">Best Practice 10:
Maintain the confidentiality of user data in
transmission, for example using <code>HTTPS</code> for
transport rather than <code>HTTP</code>.
@@ -243,8 +221,7 @@
</p>
</div>
<div class="practice">
- <p><span id="bp-secure-storage"
- class="practicelab">
+ <p><span id="bp-secure-storage" class="practicelab">Best Practice 11:
Maintain the confidentiality of user data in
storage.
</span></p>
@@ -255,8 +232,41 @@
or other threats).
</p>
</div>
- </section>
- <section id='bp-summary'></section>
- </body>
-</html>
+ </div>
+ <div id="bp-summary" class="section"><!--OddPage--><h2><span class="secno">6. </span>Best Practices Summary</h2><ul><li><a href="#bp-privacy-by-design">Best Practice 1</a>: Follow "Privacy By Design" principles</li><li><a href="#bp-user-driven">Best Practice 2</a>: Enable the user to make informed decisions about
+ sharing their personal information with a service.
+ </li><li><a href="#bp-choices-in-context">Best Practice 3</a>: Enable the user to make decisions at the
+ appropriate time with the correct contextual information.
+ </li><li><a href="#bp-sp-choices">Best Practice 4</a>: When learning user privacy
+ decisions and providing defaults, allow the user to easily view and
+ change these previous decisions.
+ </li><li><a href="#bp-usability">Best Practice 5</a>: Focus on usability and avoid needless prompting.
+ </li><li><a href="#bp-clarity">Best Practice 6</a>: Be clear and
+ transparent to users regarding
+ potential privacy concerns.
+ </li><li><a href="#bp-clarify-one-shot-or-repeated">Best Practice 7</a>: Be clear as to whether information is
+ needed on a one-time basis or is necessary for a period of
+ time.
+ </li><li><a href="#bp-data-granularity">Best Practice 8</a>: Request the minimum number of data
+ items at the
+ minimum level of detail needed to provide a service.</li><li><a href="#bp-data-retention">Best Practice 9</a>:
+ Retain the minimum amount of data at the minimum level of detail for
+ the minimum amount of time needed.
+ Consider potential misuses of retained data and
+ possible countermeasures.
+ </li><li><a href="#bp-use-https">Best Practice 10</a>:
+ Maintain the confidentiality of user data in
+ transmission, for example using <code>HTTPS</code> for
+ transport rather than <code>HTTP</code>.
+ </li><li><a href="#bp-secure-storage">Best Practice 11</a>:
+ Maintain the confidentiality of user data in
+ storage.
+ </li></ul></div>
+
+
+<div id="respec-err" style="position: fixed; width: 350px; top: 10px; right: 10px; border: 3px double #f00; background: #fff" class="removeOnSave"><ul><li style="color: #c00">There appears to have been a problem fetching the style sheet; status=0</li></ul></div><div id="references" class="appendix section"><!--OddPage--><h2><span class="secno">A. </span>References</h2><div id="normative-references" class="section"><h3><span class="secno">A.1 </span>Normative references</h3><p>No normative references.</p></div><div id="informative-references" class="section"><h3><span class="secno">A.2 </span>Informative references</h3><dl class="bibliography"><dt id="bib-DAP-PRIVACY-REQS">[DAP-PRIVACY-REQS]</dt><dd>Alissa Cooper, Frederick Hirsch, John Morris. <a href="http://www.w3.org/TR/2010/NOTE-dap-privacy-reqs-20100629/"><cite>Device API Privacy Requirements</cite></a> 29 June 2010. W3C Note URL: <a href="http://www.w3.org/TR/2010/NOTE-dap-privacy-reqs-20100629/">http://www.w3.org/TR/2010/NOTE-dap-privacy-reqs-2010069/</a>
+</dd><dt id="bib-GEOLOCATION-PRIVACY">[GEOLOCATION-PRIVACY]</dt><dd>Marcos Cáceres <a href="http://www.w3.org/2010/api-privacy-ws/papers/privacy-ws-21.pdf"><cite>Privacy of Geolocation Implementations</cite></a>, "W3C Workshop on Privacy for Advanced Web APIs" paper, 12/13 July 2010. URL: <a href="http://www.w3.org/2010/api-privacy-ws/papers/privacy-ws-21.pdf">http://www.w3.org/2010/api-privacy-ws/papers/privacy-ws-21.pdf</a>
+</dd><dt id="bib-MWABP">[MWABP]</dt><dd>Adam Connors; Bryan Sullivan. <a href="http://www.w3.org/TR/2010/REC-mwabp-20101214">Mobile Web Application Best Practices.</a> 14 December 2010. W3C Recommendation. URL: <a href="http://www.w3.org/TR/2010/WD-mwabp-20101214">http://www.w3.org/TR/2010/WD-mwabp-20101214</a>
+</dd><dt id="bib-PRIVACY-BY-DESIGN">[PRIVACY-BY-DESIGN]</dt><dd>Ann Cavoukian, PhD. <a href="http://www.ipc.on.ca/images/Resources/7foundationalprinciples.pdf"><cite>Privacy By Design: The 7 Foundational Principles</cite></a>. August 2009, revised January 2011. URL: <a href="http://www.ipc.on.ca/images/Resources/7foundationalprinciples.pdf">http://www.ipc.on.ca/images/Resources/7foundationalprinciples.pdf</a>
+</dd></dl></div></div></body></html>
\ No newline at end of file
Received on Wednesday, 20 July 2011 07:49:05 UTC