future work proposal - areas 1b/c

Vocabulary issues --  primary data uses and general vocab review

A number of somewhat vague concerns have been raised about the
P3P vocabulary, especially with regards to the lack of granularity it
provides for expressing the primary purpose for which data is collected.
The P3P vocabulary focuses on secondary purposes rather than
primary purposes because these are the purposes that it was thought
users would want their agents to consider in automated decision-making.
However, companies have indicated a desire to express primary purposes
as well, and primary purposes are likely to be useful for back end
processing.

Without changing the P3P specification, sites can use the
CONSEQUENCE element to explain their primary data uses. Perhaps
the specification might be clarified to make this clear. Companies
developing back-end P3P-related products might develop their own
vocabulary for primary data uses and use the P3P extension mechanism
to integrate it into P3P policies. Once such a vocabulary is put forward,
W3C should consider whether or not a version of it should be standardized in
a future version of P3P or as a stand-alone W3C specification.

Except in the area of EU Directive compliance and agent relationships,
no other specific vocabulary issues have been raised. Thus, it seems
premature to undergo a complete review of the P3P vocabulary at this time.

My  recommendation is that the next P3P working group be chartered
to consider suggestions to clarify the meaning and use of existing
P3P vocabulary elements and vocabulary changes to address the specific
concerns that have been raised that may impact P3P implementation
and adoption. A deadline should be set for raising vocabulary-related
issues for consideration in the P3P1.1 timeframe.

Should a future P3P working group be chartered following the P3P1.1
work, that group might take on a more thorough review and possible
overhaul of the P3P vocabulary.

Lorrie Cranor

Received on Wednesday, 11 December 2002 11:10:54 UTC