Re: June Change Proposal: text on de-identification

I'm not sure what the out-of-scope statement is meant to signify…  Seems to me the key is whether the data is de-identified or not..


On Jun 25, 2013, at 9:58 AM, David Singer <singer@apple.com> wrote:

> By the way, the draft contains two different statements about de-identified data in section 5:
> 
> "When a third party receives a DNT:1 signal, that third party may nevertheless collect, retain, share or use data related to that network interaction if the data is de-identified as defined in this specification."
> 
> and
> 
> "It is outside the scope of this specification to control the collection and use of de-identified data."
> 
> I think the second is the correct statement, isn't it?  (If it truly isn't 'tracking' data, it's not in scope).  Is this an editorial oversight, or should I post a change proposal?
> 
> 
> On Jun 25, 2013, at 0:28 , Nicholas Doty <npdoty@w3.org> wrote:
> 
>> Hi David,
>> 
>> I've updated the de-identification page to include your proposal next to the other and the editors' draft text: http://www.w3.org/wiki/Privacy/TPWG/Change_Proposal_Deidentification
>> 
>> I'm not sure what the intended exact language is for the level of confidence. Last year's Working Draft included an option that used "high probability that it contains only information that could not be linked ... by a skilled analyst", but I'm not sure that's from Ed in particular or what you had in mind.
>> 
>> Thanks,
>> Nick
>> 
>> On Jun 20, 2013, at 3:06 PM, David Singer <singer@apple.com> wrote:
>> 
>>> Problem
>>> 
>>> "Data is deidentified when a party:
>>> 
>>> 	• has achieved a reasonable level of justified confidence that the data cannot be used to infer information about, or otherwise be linked to, a particular consumer, computer, or other device;
>>> 	• commits to try not to reidentify the data; and
>>> 	• contractually prohibits downstream recipients from trying to re-identify the data."
>>> 
>>> 1) We have had (from Ed?) text that suggests better wording than "reasonable level of justified confidence" .
>>> 
>>> 2) If we have a definition of 'tracking' data, we should use it.  
>>> 
>>> 3) "downstream" is undefined, and actually we don't care where in a hypothetical stream you are, we want the data not to identify.  
>>> 
>>> Proposal:
>>> 
>>> 1)  I think it was something like "to a generally accepted high level of confidence".  I suggest we find text that says that basically you're doing as well as the normal state of the art.
>>> 
>>> 2) Suggest "the data is not, and cannot be made into, tracking data" instead of "cannot be used to infer information about, or otherwise be linked to, a particular consumer, computer, or other device"
>>> 
>>> 3) Delete "downstream" or replace it with "any".
>>> 
>>> 
>>> David Singer
>>> Multimedia and Software Standards, Apple Inc.
> 
> David Singer
> Multimedia and Software Standards, Apple Inc.
> 
>

Received on Tuesday, 25 June 2013 17:08:35 UTC