RE: Identity providers as first parties

Tamir,

That's up to local laws to determine.  Please do not attempt to legislate via W3C tech standard.

- Shane

-----Original Message-----
From: Tamir Israel [mailto:tisrael@cippic.ca] 
Sent: Sunday, June 17, 2012 12:14 PM
To: Shane Wiley
Cc: Rigo Wenning; public-tracking@w3.org; rob@blaeu.com; Kimon Zorbas; ifette@google.com; JC Cannon (Microsoft)
Subject: Re: Identity providers as first parties

Shane -- Out of band consent *does* trump DNT-1. We are now trying to 
define the parameters by which out of band consent can be sought.

Best,
Tamir

On 6/17/2012 3:11 PM, Shane Wiley wrote:
> Tamir,
>
> Out-of-band consent trumps DNT.  We've been repeating this mantra for over a year now - becoming repetitive.
>
> - Shane
>
> -----Original Message-----
> From: Tamir Israel [mailto:tisrael@cippic.ca]
> Sent: Saturday, June 16, 2012 5:23 PM
> To: Shane Wiley
> Cc: Rigo Wenning; public-tracking@w3.org; rob@blaeu.com; Kimon Zorbas; ifette@google.com; JC Cannon (Microsoft)
> Subject: Re: Identity providers as first parties
>
> Shane --
>
> Just so we're really clear: if a user authenticates with Yahoo! on site
> A and controls preferences on that site, does the out of band consent
> dialogue Jonathan showed invalidate DNT-1: on site A? in general?
>
> Best,
> Tamir
>
> On 6/15/2012 11:29 PM, Tamir Israel wrote:
>> Ok.
>>
>> On 6/15/2012 2:07 PM, Shane Wiley wrote:
>>> DAA Opt-out and single-sign on are not related.  There are some
>>> implementations where the ID is needed beyond the authentication
>>> event and therefore data collection occurs outside of the initial
>>> authentication event.  Users do NOT need to choose Yahoo! as their ID
>>> provider if they feel uncomfortable with that outcome.
>>>
>>> - Shane
>>>
>>> -----Original Message-----
>>> From: Tamir Israel [mailto:tisrael@cippic.ca]
>>> Sent: Friday, June 15, 2012 10:56 AM
>>> To: Shane Wiley
>>> Cc: Rigo Wenning; public-tracking@w3.org; rob@blaeu.com; Kimon
>>> Zorbas; ifette@google.com; JC Cannon (Microsoft)
>>> Subject: Re: Identity providers as first parties
>>>
>>> Shane,
>>>
>>> Maybe we are getting sidetracked.
>>>
>>> Can you please explain the scope of tracking that results from using
>>> Yahoo!'s IdM mechanism? Does it mean you can track all my activities on
>>> the specific authenticated site? If so does this carry across multiple
>>> explicitly authenticated sites? Does it operate in a manner analogous to
>>> single sign-on? How does it interact with the existing DAA opt-out?
>>>
>>> Thanks and best regards,
>>> Tamir
>>>
>>> On 6/15/2012 11:28 AM, Shane Wiley wrote:
>>>> Tamir,
>>>>
>>>> Any service gets to determine its own primary purpose - so if OBA is
>>>> the payment for the service and this is disclosed as a primary
>>>> purpose, then that's the bargain the users can choose to consent to
>>>> or not.
>>>>
>>>> - Shane
>>>>
>>>> -----Original Message-----
>>>> From: Tamir Israel [mailto:tisrael@cippic.ca]
>>>> Sent: Friday, June 15, 2012 8:21 AM
>>>> To: Shane Wiley
>>>> Cc: Rigo Wenning; public-tracking@w3.org; rob@blaeu.com; Kimon
>>>> Zorbas; ifette@google.com; JC Cannon (Microsoft)
>>>> Subject: Re: Identity providers as first parties
>>>>
>>>> Shane --
>>>>
>>>> There are 2 questions here. One is whether you can bundle in the
>>>> obligation to consent to secondary purposes as a condition of
>>>> authentication in an IdM context. The primary service in an IdM context
>>>> is authentication, not OBA.
>>>>
>>>> The second is to what extent the DNT spec should address this. I took
>>>> the 'independent choice' out of band consent criteria as an attempt to
>>>> prevent bundling of choices.
>>>>
>>>> Best,
>>>> Tamir
>>>>
>>>> On 6/15/2012 11:06 AM, Shane Wiley wrote:
>>>>> Tamir,
>>>>>
>>>>> But in the use case we're discussing the service being provided is
>>>>> the primary purpose - a user's online identity.  A service
>>>>> determines its primary purpose, discloses this to the user, user
>>>>> consents.  Case closed.
>>>>>
>>>>> - Shane
>>>>>
>>>>> -----Original Message-----
>>>>> From: Tamir Israel [mailto:tisrael@cippic.ca]
>>>>> Sent: Friday, June 15, 2012 8:02 AM
>>>>> To: Shane Wiley
>>>>> Cc: Rigo Wenning; public-tracking@w3.org; rob@blaeu.com; Kimon
>>>>> Zorbas; ifette@google.com; JC Cannon (Microsoft)
>>>>> Subject: Re: Identity providers as first parties
>>>>>
>>>>> Shane, I disagree. Under PIPEDA you should offer users the possibility
>>>>> of opting out of collection, use or disclosure for purposes
>>>>> secondary to
>>>>> the primary service being offered.
>>>>>
>>>>> This is the basis of the opt-out consent scheme being applied to
>>>>> online
>>>>> tracking.
>>>>>
>>>>> Best,
>>>>> Tamir
>>>>>
>>>>> On 6/15/2012 10:58 AM, Shane Wiley wrote:
>>>>>> Tamir,
>>>>>>
>>>>>> I disagree and PIPEDA does as well.  As long as you're clear to a
>>>>>> user what a service provides and a user expressly consents to
>>>>>> those practices, the discussion is over.
>>>>>>
>>>>>> Please don't try to raise CA regulatory schemes into conversations
>>>>>> on one hand then completely reverse your stance at whim - this
>>>>>> seriously undermines your credibility.
>>>>>>
>>>>>> - Shane
>>>>>>
>>>>>> -----Original Message-----
>>>>>> From: Tamir Israel [mailto:tisrael@cippic.ca]
>>>>>> Sent: Friday, June 15, 2012 7:54 AM
>>>>>> To: Shane Wiley
>>>>>> Cc: Rigo Wenning; public-tracking@w3.org; rob@blaeu.com; Kimon
>>>>>> Zorbas; ifette@google.com; JC Cannon (Microsoft)
>>>>>> Subject: Re: Identity providers as first parties
>>>>>>
>>>>>> Shane --
>>>>>>
>>>>>> The need for independent choice is critical, I think, to the out
>>>>>> of band
>>>>>> consent scheme. You shouldn't be able to force users out of their DNT
>>>>>> choices as a condition of authentication.
>>>>>>
>>>>>> Best,
>>>>>> Tamir
>>>>>>
>>>>>> On 6/15/2012 10:48 AM, Shane Wiley wrote:
>>>>>>> Rigo,
>>>>>>>
>>>>>>> DNT will NEVER trump an out-of-band consent.  The user would
>>>>>>> simply withdraw from using the service they had provided prior
>>>>>>> consent to.  If the product would like to offer two levels of
>>>>>>> service, it can of course do that, but that would be completely
>>>>>>> outside the scope of DNT.
>>>>>>>
>>>>>>> DNT is not the privacy silver bullet and answer to all privacy
>>>>>>> issues on the Internet - let's stop trying to push it in that
>>>>>>> direction.
>>>>>>>
>>>>>>> Thank you,
>>>>>>> - Shane
>>>>>>>
>>>>>>> -----Original Message-----
>>>>>>> From: Rigo Wenning [mailto:rigo@w3.org]
>>>>>>> Sent: Friday, June 15, 2012 1:28 AM
>>>>>>> To: public-tracking@w3.org
>>>>>>> Cc: Shane Wiley; rob@blaeu.com; Kimon Zorbas; ifette@google.com;
>>>>>>> Tamir Israel; JC Cannon (Microsoft)
>>>>>>> Subject: Re: Identity providers as first parties
>>>>>>>
>>>>>>> Shane, Kimon,
>>>>>>>
>>>>>>> On Thursday 14 June 2012 16:47:03 Shane Wiley wrote:
>>>>>>>> I’ve used a few others and they appears to do the same so I’m
>>>>>>>> confused as to what real-world identity provider scenario someone
>>>>>>>> is considering where consent wasn’t already obtained?
>>>>>>> I confirm that we agreed that the out-of-band agreement will trump
>>>>>>> the DNT:1 signal. We also agreed that the service has to signal this
>>>>>>> to the client.
>>>>>>>
>>>>>>> I guess, what Rob is trying to achieve is to say, even in this
>>>>>>> context, a service could offer the choice of stopping to track and
>>>>>>> only use information for the login/authentication purpose. This
>>>>>>> could be the meaning of DNT:1 if the Service sends ACK in a
>>>>>>> login/authentication context. If you're looking for medical
>>>>>>> information in a login context, you don't want your login provider
>>>>>>> to spawn that to your insurance. I think this is a very legitimate
>>>>>>> use case. The service could say: "yes, I see your point" and send
>>>>>>> ACK instead of "out-of-band".
>>>>>>>
>>>>>>> We are just defining switches. People will decide whether they
>>>>>>> switch stuff on or off or provide a switch at all.
>>>>>>>
>>>>>>> Rigo

Received on Sunday, 17 June 2012 19:17:08 UTC