RE: updated draft charter

Clarifications inline as requested.

Thanks,
Bryan Sullivan 

-----Original Message-----
From: Dave Raggett [mailto:dsr@w3.org] 
Sent: Wednesday, June 06, 2012 5:15 AM
To: public-sysapps@w3.org
Subject: Re: updated draft charter



On 06/06/12 04:24, SULLIVAN, BRYAN L wrote:
> On the privacy aspects, I think it would be a good time to take a
> system-level approach to that across these APIs. Thus I propose that
> we add a Privacy API to the phase 1, with the objective of providing
> to the user whatever information is relevant to the privacy related
> characteristics of all apps on the device, and related system-wide
> controls for the same. For example, in the DNT discussion it's been
> noted that diverse implementations in web user agents (of which there
> can be multiple) and web-enabled apps can lead to fragmented and
> inconsistent representations of user privacy preferences. Thus it
> would be good to enable management of preferences system-wide, and
> ensure that the applicable signals are always used (e.g. DNT header).
> The objective of the API would not be to mandate any UI aspects, but
> to provide the ability of apps to disclose privacy related
> characteristics, and the ability of suitably authorized apps to read
> those characteristics and manage system-wide privacy settings.

It is a bit late to add a privacy API deliverable to the questionnaire,
so I hope that others can respond to Bryan's suggestion via email.

Bryan: could you expand further on what you have in mind? My initial
reading is that you are asking for an API to access and update privacy
preferences, and for applications to indicate their privacy policies.
[bryan] Correct. In terms of effect upon privacy, users need to know what they are letting in the door, what is leaving through the door, and be able to limit both.

I can envisage a privacy management application that allows you to view
what privacy related permissions were set for given applications. There
are for example, Android apps for this, although they require a rooted
device to update the settings. This would be closely related to the
existing deliverables on the security and execution models.
[bryan] That's the idea in terms of UX.

Whilst I hesitate to mention P3P, a lot of good work was done on a
vocabulary for privacy policies covering what data is collected, who it
may be shared with and under what retention policy. P3P as it was
originally specified proved too hard to provide full implementations.
Microsoft's compact policies provided a simple solution, but only
covered cookies. A couple of years back I did some work for the
PrimeLife project on a broader subset of P3P that is easy to implement,
as I proved in the form of a Firefox add-on, see:

   http://www.w3.org/2010/09/raggett-fresh-take-on-p3p/
[bryan] I also led the definition of a schema for privacy related disclosures intended to be linked to widget packages via the <link> element, in WAC. This was based upon the W3C POWDER spec and IMO represented a solidly valuable proposal on how apps can disclose privacy implications for API usage. I would like to see something similar supported under Sysapps at some point, though I understand that the authoring, validation, and UI aspects of presenting this info are challenging - this is why AFAICT it is not still in the published WAC specs (it was as of the commercial release of WAC, but we have not been involved for a while...). Nonetheless, this is such an important area for users that I think the challenge has to be met somehow.

>From the W3C workshop on Privacy and data usage, in October 2010:

   http://www.w3.org/2010/policy-ws/

Do Not Track has now re-opened the door for work on richer means for web
sites to express their policies, but I suspect that it is still too
early to begin standardizing. P3P's vocabulary is a valuable input, but
we need further work to better understand the landscape beyond DNT.

I anticipate a growing role for apps like "Lookout" that warn when you
try to install malware, and also provide warnings relating to privacy.
The next step will be to provide warnings according to the user's
privacy profile, e.g. carefree, cautious, or paranoid, and to take into
account independent third party assessments rather than just relying on
the website or app's stated privacy policy.

[bryan] I think that enabling apps that the user trusts (via whatever criteria) to inform the user of privacy implications and set related preferences, would be a key step forward. That's the essence of the intent in asking for this Privacy API.
-- 
Dave Raggett <dsr@w3.org> http://www.w3.org/People/Raggett

Received on Friday, 8 June 2012 01:11:01 UTC