Re: [/TR/privacy-principles/] Formal Objection (Proposed Statement review)

The Council resolved to overrule the objection.

https://www.w3.org/2025/05/council-privacy-principles-report.html#decision

On 4/14/2025 10:21 AM, Philippe Le Hégaret wrote:
> From
>    https://www.w3.org/wbs/33280/PPrinciplesChanges/results/
> 
> <Member> wrote:
> [[
> 1) Confusing the marketplace – the TAG cannot operate outside “W3C 
> itself nor its Members” – hence if it is not endorse by either it is 
> premature to publish material that may be objectionable to most members
> 
> a. “This Group Note is endorsed by the Technical Architecture Group, but 
> is not endorsed by W3C itself nor its Members.”
> 
> 2) Principle 2.2.1-2.2.2 assume ALL data is Personal Data subject to 
> unilateral control of visitors to media owner properties – they deserve 
> to protect themselves from fraud at the malicious direction of a “user” 
> – this explicitly contradicts Principle 2.6 and contrasts with Principle 
> 2.2.4 that explicitly states not all data is “sensitive”
> 
> a. “Principle 2.2.1: Sites, user agents, and other actors should 
> restrict the data they transfer to what's either necessary to achieve 
> their users' goals or aligns with their users' wishes and interests.”
> 
> 3) Principle 2.2.1.1 assumes user agent ALONE and paternalistically 
> dictate “appropriate choices” than ensure users are “meaningfully 
> informed” as to a choice contradicting Principle 2.11.2
> 
> a. “…so that user agents can provide appropriate choices for their users.”
> 
> 4) Principle 2.6 recognizes all data is not Personal and hence such data 
> does is explicitly excluded from “privacy” concerns AND most principles 
> fail to distinguish when they are talking about an individual’s Personal 
> Data and data that is not under their exclusive control (e.g., 
> deidentified data is by definition no longer associated with any 
> individual)
> 
> a. “Whenever possible, processors should work with data that has been 
> de-identified.”
> 
> 5) Principle 2.8 uses loaded rather than fair, neutral language and 
> tacitly assumes all data collection is “surveillance” which might only 
> be appropriate for organizations that reidentify individuals rather than 
> internet-connected devices
> 
> 6) Principle 2.12.2 confuses privacy protections with user experience 
> choices that media owners’ control – after all there is no right to 
> other people’s online property
> 
> 7) Principle 2.13.1 against uses loaded rather than fair, neutral 
> language with “manipulated” without defining what is permissible 
> recommendations and information disclosures vs inappropriate ones
> ]]
> 
>

Received on Tuesday, 13 May 2025 11:46:54 UTC