action-277, proposed edit to compliance

I think we basically agreed this in the face-to-face, but it was made into an action item so I could find the right form of words and the right place to put them:

to section 6.1.1.2 of the compliance document, which currently reads:

Data retained by a party for permitted uses must be limited to the data reasonably necessary for such permitted uses, and must be retained no longer than is reasonably necessary for such permitted uses. Third parties must make reasonable data minimization efforts to ensure that only the data necessary for the permitted use is retained. A third party must provide public transparency of their data retention period. The third party may enumerate each individually if they vary across Permitted Uses. Once the period of time for which you have declared data retention for a given use has expired, the data must not be used for that permitted use. After there are no remaining Permitted Uses for given data, the data must be deleted or rendered unlinkable.

add:

A contract or other specification can serve to support reasonable of the need for the actual data retained, or of period the data for which the data is retained, but not if the requirements of the contract are themselves not reasonable.

David Singer
Multimedia and Software Standards, Apple Inc.

Received on Monday, 29 October 2012 15:35:27 UTC