service provider definition/context Re: June Draft of the DNT compliance spec

Hi Vinay,

Perhaps we could take the same approach as with the other party definitions, which is to define them within the context of a specific interaction. That is, could we start the definition with the same clause that starts the first-party definition:
   "In the context of a specific network interaction,"

—Nick

On Jun 10, 2013, at 9:03 AM, Vinay Goel <vigoel@adobe.com> wrote:

> Hi Peter and staff,
> 
> Thanks for all of the time/effort you guys have put into this.  Quick question on the definition of Service Provider.  What is your/the group's opinion on deleting the word only in (1) below?  My concern over the word only is that the service provider acts on behalf of many clients, not just one.  And, the service provider may in fact be a data controller (collecting/using data for its own purposes) on its own sites for its own marketing programs.  I know I'm being picky here, but to me, the word 'only' suggests that the service provider can act on behalf of one company only.  As a suggested change, would you/the group be okay with '(1) is acting as a data processor on behalf of the client;'?  I'm open to other suggested changes as well that makes it clear that a service provider may have other operations (and yes, I realize that when the company is not operating as a data processor on behalf of the client, then it takes on its own set of rules and cannot rely on the rules placed upon the client).
> 
> Copied definition:
> "An outsourced service provider is considered to be the same party as its client if the
> service provider:
> 1. acts only as a data processor on behalf of the client;
> 2. ensures that the data can only be accessed and used as directed by that client;
> 3. has no independent right to use or share the data except as necessary to ensure
> the integrity, security, and correct operation of the service being provided; and
> 4. has a contract in place that outlines and mandates these requirements."
> 
> -Vinay