RE: ACTION-75: Write-up a hybrid of Do Not Profile and Do Not Cross-Site Track

Shane,

First, I agree with you that we should leverage minimization principles instead of using arbitrary numbers. 

I do agree that the industry standard is to remove quasi-identifiers after 18 months. My previous email may have been out of scope, but I wanted to clarify that there is currently no log retention time limit (search logs are never deleted). In DNT context I think it would be better to delete logs rather than anonymize them (but that could be discussed elsewhere).


Sorry for the confusion,

Vincent


-----Message d'origine-----
De : Shane Wiley [mailto:wileys@yahoo-inc.com] 
Envoyé : dimanche 12 février 2012 22:25
À : Vincent Toubiana
Cc : public-tracking@w3.org; rigo@w3.org; JC Cannon
Objet : RE: ACTION-75: Write-up a hybrid of Do Not Profile and Do Not Cross-Site Track

Vincent,

I disagree and would repeat that the facts support 18 months for search engines is now the industry standard - with variations of anonymization methods supporting that timeframe.

- Shane

-----Original Message-----
From: Vincent Toubiana [mailto:v.toubiana@free.fr] 
Sent: Sunday, February 12, 2012 11:56 AM
To: Shane Wiley
Cc: public-tracking@w3.org; rigo@w3.org; JC Cannon
Subject: Re: ACTION-75: Write-up a hybrid of Do Not Profile and Do Not Cross-Site Track

Shane,

A couple of details regarding search log retention.

Actually there is no consensus about the log retention time, even after 
18 months Google keeps search logs. They do *pseudonymize* them at two 
different period of time (9 months and 18 months) but never truly 
anonymize them. As far as I know, Article 29 has repeatdly asked Yahoo!, 
Google and MSFT to reduce the retention of personal information 
(including IP) to 6 months(see http://www.out-law.com/page-11884). 
Search engines somehow complied by modifying the IP address in their 
logs after 6 months (only Google keep them for 9 months) but I don't 
think that actually matches the Article 29 expectation.

Since there is no current consensus on log retention and that Article 29 
recommends 6 months, I'd suggest to use this as the standard.

Vincent


> If we're going to use arbitrary time spans for retention, I would recommend that we leverage 18 months as the standard.  This is the time Google, MSFT, and Yahoo! currently use for search logs and have shared this policy with all of the EU DPAs and A29WP.  As the advocates in this working group will likely share the perspective of wanting this to be lower in common with EU DPAs, it's a helpful starting point.  Otherwise we can stop using arbitrary numbers and leverage minimization principles instead - which I personally believe are the better standard to apply to varied business models and can stand the test of time and innovation.
>
> - Shane
>
> -----Original Message-----
> From: Rigo Wenning [mailto:rigo@w3.org]
> Sent: Thursday, February 09, 2012 9:06 AM
> To: public-tracking@w3.org
> Cc: JC Cannon
> Subject: Re: ACTION-75: Write-up a hybrid of Do Not Profile and Do Not Cross-Site Track
>
> I concur JC,
>
> On Tuesday 07 February 2012 18:51:27 JC Cannon wrote:
>> It seems that we are still conflating collection with receipt of logs by a
>> server and processing of those logs for placement in a profile or
>> otherwise.
>>
>> I believe we all agreed that web servers must be able to receive logs in
>> order for the Internet to work as it does. I would like to propose that the
>> mere receipt of logs by a web server should not be considered collection or
>> be constrained by the rules of collection.
>>
>> However, any processing of the logs should be considered collection and be
>> governed by our DNT standard.
>>
>> Inasmuch as the logs will include a DNT signal, any retention policy that
>> comes out of our standard should apply to those logs.
>>
> Whereas 22 of the ePrivacy Directive says:
>
> The prohibition of storage of communications and the related traffic data by
> persons other than the users or without their consent is not intended to
> prohibit any automatic, intermediate and transient storage of this information
> in so far as this takes place for the sole purpose of carrying out the
> transmission in the electronic communications network and provided that the
> information is not stored for any period longer than is necessary for the
> transmission and for traffic management purposes, and that during the period of
> storage the confidentiality remains guaranteed. Where this is necessary for
> making more efficient the onward transmission of any publicly accessible
> information to other recipients of the service upon their request, this
> Directive should not prevent such information from being further stored,
> provided that this information would in any case be accessible to the public
> without restriction and that any data referring to the individual subscribers
> or users requesting such information are erased.
>
> As long as we talk about some defaults for retention and logging for the
> purpose of carrying out the communication, we shouldn't prevent logging. I
> think our task is beyond. We MAY give some hint when we believe those logs are
> not necessary anymore.
>
> So while writing logs is collection of data, we may declare normal web logs
> out of scope as long as they do not serve to build profiles and as long as they
> have some expiry set. (One may be as scared about logs that last forever then
> I would be scared about profile creation)
>
> Consequently, a third party that is not in an outsourcing context may not
> collect data beyond normal web logs and should anonymize or erase those logs
> after 60 Days (just to throw in some arbitrary count) This would be my
> suggestion.
>
> Best,
>
> Rigo
>
>

Received on Monday, 13 February 2012 17:45:56 UTC