RE: <DCCF036E573F0142BD90964789F720E31407D8E5@GQ1-MB01-02.y.corp.yahoo.com>

Mike,

That is the accountability element (technical + operational + administrative controls) of the solution - this is not a pure tech solution.  While I understand that an absolute technical solution in isolation equates to full deletion (as you suggest), there are many gradients of acceptable solutions short of full deletion.  In this proposal, organizations are committing to developing a internal implementation that does NOT allow the targeting of an individual.  The purpose of persistent identifier retention (not connected to the real user) is for consistency in reporting - that is all.  As long as an organization has placed the necessary controls in place to reasonably defend that de-identified records cannot be reverse engineered back to a real user/device then the solution is sound.

- Shane

From: Mike O'Neill [mailto:michael.oneill@baycloud.com]
Sent: Thursday, May 16, 2013 7:22 AM
To: Shane Wiley
Cc: John Simpson; rob@blaeu.com; public-tracking@w3.org
Subject: <DCCF036E573F0142BD90964789F720E31407D8E5@GQ1-MB01-02.y.corp.yahoo.com>

Hi Shane,

I just saw your message (for some unfathomable reason I never get your messages to the list forwarded on to me by e-mail).

The problem of any data that contains a persistent UID is that it can always be used to target an individual. You could de-identify each data point as much as you like but further data points collected from the same individual will be appended to it. If the data is so "de-identified" that it no longer contains a derived profiling category (say), then what is the point of retaining the persistent identifier. It would be better for transparency just to delete it. Or just make the duration as short as possible to meet the necessary requirements of any permitted use.

All the evidence we have had indicates that this can be very short.

Mike




From: Shane Wiley <wileys@yahoo-inc.com<mailto:wileys@yahoo-inc.com?Subject=RE%3A%20ISSUE-198%3A%20Define%20new%20word%20for%20yellow%20state%20due%20to%20the%20fact%20%20%20that%20%20the%20process%20of%20de-identification%20spans%20all%20three%20states%20(red%2Cyellow%20%20%20and%20%20green).&In-Reply-To=%253CDCCF036E573F0142BD90964789F720E31407D8E5%40GQ1-MB01-02.y.corp.yahoo.com%253E&References=%253CDCCF036E573F0142BD90964789F720E31407D8E5%40GQ1-MB01-02.y.corp.yahoo.com%253E>>
Date: Wed, 15 May 2013 21:23:07 +0000
To: "Mike O'Neill" <michael.oneill@baycloud.com<mailto:michael.oneill@baycloud.com?Subject=RE%3A%20ISSUE-198%3A%20Define%20new%20word%20for%20yellow%20state%20due%20to%20the%20fact%20%20%20that%20%20the%20process%20of%20de-identification%20spans%20all%20three%20states%20(red%2Cyellow%20%20%20and%20%20green).&In-Reply-To=%253CDCCF036E573F0142BD90964789F720E31407D8E5%40GQ1-MB01-02.y.corp.yahoo.com%253E&References=%253CDCCF036E573F0142BD90964789F720E31407D8E5%40GQ1-MB01-02.y.corp.yahoo.com%253E>>, "'John Simpson'" <john@consumerwatchdog.org<mailto:john@consumerwatchdog.org?Subject=RE%3A%20ISSUE-198%3A%20Define%20new%20word%20for%20yellow%20state%20due%20to%20the%20fact%20%20%20that%20%20the%20process%20of%20de-identification%20spans%20all%20three%20states%20(red%2Cyellow%20%20%20and%20%20green).&In-Reply-To=%253CDCCF036E573F0142BD90964789F720E31407D8E5%40GQ1-MB01-02.y.corp.yahoo.com%253E&References=%253CDCCF036E573F0142BD90964789F720E31407D8E5%40GQ1-MB01-02.y.corp.yahoo.com%253E>>
CC: "rob@blaeu.com<mailto:rob@blaeu.com?Subject=RE%3A%20ISSUE-198%3A%20Define%20new%20word%20for%20yellow%20state%20due%20to%20the%20fact%20%20%20that%20%20the%20process%20of%20de-identification%20spans%20all%20three%20states%20(red%2Cyellow%20%20%20and%20%20green).&In-Reply-To=%253CDCCF036E573F0142BD90964789F720E31407D8E5%40GQ1-MB01-02.y.corp.yahoo.com%253E&References=%253CDCCF036E573F0142BD90964789F720E31407D8E5%40GQ1-MB01-02.y.corp.yahoo.com%253E>" <rob@blaeu.com<mailto:rob@blaeu.com?Subject=RE%3A%20ISSUE-198%3A%20Define%20new%20word%20for%20yellow%20state%20due%20to%20the%20fact%20%20%20that%20%20the%20process%20of%20de-identification%20spans%20all%20three%20states%20(red%2Cyellow%20%20%20and%20%20green).&In-Reply-To=%253CDCCF036E573F0142BD90964789F720E31407D8E5%40GQ1-MB01-02.y.corp.yahoo.com%253E&References=%253CDCCF036E573F0142BD90964789F720E31407D8E5%40GQ1-MB01-02.y.corp.yahoo.com%253E>>, "'Tracking Protection Working Group'" <public-tracking@w3.org<mailto:public-tracking@w3.org?Subject=RE%3A%20ISSUE-198%3A%20Define%20new%20word%20for%20yellow%20state%20due%20to%20the%20fact%20%20%20that%20%20the%20process%20of%20de-identification%20spans%20all%20three%20states%20(red%2Cyellow%20%20%20and%20%20green).&In-Reply-To=%253CDCCF036E573F0142BD90964789F720E31407D8E5%40GQ1-MB01-02.y.corp.yahoo.com%253E&References=%253CDCCF036E573F0142BD90964789F720E31407D8E5%40GQ1-MB01-02.y.corp.yahoo.com%253E>>
Message-ID: <DCCF036E573F0142BD90964789F720E31407D8E5@GQ1-MB01-02.y.corp.yahoo.com<mailto:DCCF036E573F0142BD90964789F720E31407D8E5@GQ1-MB01-02.y.corp.yahoo.com>>
Mike,

The tri-state de-identification process attempts to solve for a middle ground such that activity can be collected against a persistent identifier but that identifier is not able to connect to devices/users in the real-world so profiling/targeting to an actual data subject does not occur.  There is some risk in this model so to further remove that risk a third state is defined that removes the persistence in identifiers (or removes the identifiers completely) so there is no/less risk of re-identification.

- Shane